{"id":"CVE-2026-117685","kind":"vulnerability","aliases":["CVE-2026-117685"],"related":[],"title":"OCI registry blob mount lets a token copy private package data public","description":"The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope, whose owner can read a private package and write to a public package namespace, could mount a blob of the private package into the public package. The private blob, such as a container layer, could then be downloaded by anyone through the public package.","summary":"The OCI registry's cross-repository blob mount checked the target package against a token's public-only restriction but checked the source blob only against the token owner's full permissions. A public-only token with write scope could mount a private package's blob, such as a container layer, into a public package, where anyone can download it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["container-registry","infrastructure","oci-registry","self-hosted"],"not_affected_if":["no-private-packages","no-public-only-tokens"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T10:18:35+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:27+00:00","updated_at":"2026-11-01T10:51:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-01T10:51:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OCI registry blob mount lets a token copy private package data public","impact":"medium","summary":"The OCI registry's cross-repository blob mount checked the target package against a token's public-only restriction but checked the source blob only against the token owner's full permissions. A public-only token with write scope could mount a private package's blob, such as a container layer, into a public package, where anyone can download it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["oci-registry","container-registry","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"private container layers become publicly downloadable through a public package","analyst_note":"Identify which registry product and versions are affected and whether a fixed release exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117685.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-private-packages","no-public-only-tokens"],"who_is_affected":"Teams that host an OCI-compatible container registry with private and public package namespaces and issue public-only tokens with write:package scope to owners who can read private packages. The sources do not name the affected registry product or versions. Teams that do not run such a registry can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":4144,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117685':15A,18A '-2026':14A,17A 'account':121C 'anyon':88B,175C 'blob':3A,36B,54B,77B,98C,116C,153C,164C 'check':38B,51B,100C,113C 'contain':20B,81B,168C 'container-registri':19B 'copi':8A 'could':71B,150C,170C 'cross':34B,96C 'cross-repositori':33B,95C 'cve':13A,16A 'data':11A 'download':90B,173C 'full':61B,120C 'host':28B 'infrastructur':22B 'layer':82B,169C 'let':5A 'mount':4A,37B,72B,99C,151C 'namespac':149C 'oci':1A,24B,30B,92C 'oci-registri':23B 'owner':59B,126C,137C 'packag':10A,41B,75B,86B,103C,134C,142C,148C,157C,161C,179C 'permiss':62B,122C 'privat':9A,74B,141C,156C,163C 'public':12A,47B,65B,85B,109C,129C,147C,160C,178C 'public-on':46B,64B,108C,128C 'read':139C 'registri':2A,21B,25B,31B,93C 'repositori':35B,97C 'restrict':49B,111C 'scope':70B,135C 'self':27B 'self-host':26B 'sourc':53B,115C 'target':40B,102C 'token':7A,44B,58B,67B,106C,125C,131C 'whose':136C 'write':69B,133C,144C","nicknames":[],"mitigations":[],"who_affected":"Teams that host an OCI-compatible container registry with private and public package namespaces and issue public-only tokens with write:package scope to owners who can read private packages. The sources do not name the affected registry product or versions. Teams that do not run such a registry can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117685","severity":null,"published_at":"2026-11-01T10:18:35+00:00","modified_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}