CVE-2026-117685

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

EUVD-2026-114801

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...

PT-2026-134877

The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a private package and...