Go/github.com/distribution/distribution CVE-2026-33540: high 7.5, EPSS 0.27%

Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-3p65-76g6-3w7r#Go/github.com/distribution/distribution
• https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r
• https://nvd.nist.gov/vuln/detail/CVE-2026-33540
• https://github.com/distribution/distribution/commit/cc5d5fa4ba02157501e6afa2cc6a903ad0338e7b
• https://github.com/distribution/distribution

CVE-2026-33540 · published 2026-04-06T17:52:52Z · modified 2026-09-10T03:50:42.426312501Z · JSON