CVE-2026-61833

zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...