Security Advisory: Unauthorized Deletion in zot via Bearer Token Scope Misconfiguration

According to the GitHub Security Advisory database, a high-severity vulnerability has been identified in project-zot/zot. The issue, published on September 18, 2026, involves the improper mapping of HTTP DELETE requests to the "push" scope in bearer authentication. This misconfiguration allows clients with bearer tokens that only have "pull" and "push" scopes to delete manifests and blobs from a zot registry. The vulnerability arises due to two key flaws: the collapse of HTTP method mappings in the authentication handler and the bypass of fine-grained authorization middleware for bearer-authenticated requests. Additionally, the affected handlers for manifest and blob deletion lack independent authorization checks, further exacerbating the problem. This behavior deviates from the Docker Distribution Token Authentication Specification, which explicitly defines "delete" as a distinct scope.

Operators should carefully assess their registry's token configurations and scope assignments before upgrading. If your deployment relies on bearer tokens with limited scopes for security isolation, this vulnerability could allow unauthorized deletions, disrupting workflows or compromising data integrity. It is crucial to verify whether compensating controls, such as external API gateways or middleware enforcing proper scope validation, are in place to mitigate the risk. This issue highlights the importance of adhering to specification-defined scope distinctions, a recurring pattern in security advisories for container registry software.