A critical Server-Side Request Forgery vulnerability in the Distribution container toolkit exposes upstream registry credentials to unauthorized parties, posing a significant risk to supply chain security.

This vulnerability occurs in pull-through cache mode when the software fails to validate the realm URL during token authentication. An unauthenticated attacker can manipulate the upstream registry response to force the application to send sensitive credentials to an attacker-controlled endpoint.

The compromise of registry credentials can lead to unauthorized access to private container images and proprietary intellectual property. With a CVSS score of 7.5, this high-severity flaw threatens the integrity of the software supply chain and could facilitate further lateral movement within the cloud environment.

Immediate Action: Update the Distribution toolkit to version 3.1.0 or later to ensure proper validation of authentication realm URLs.

Proactive Monitoring: Review egress traffic logs for connections to unknown or suspicious registry endpoints, particularly those originating from servers configured with pull-through caching.

Compensating Controls: Implement strict network egress filtering on container registry hosts to prevent unauthorized communication with untrusted external domains.

Public Exploit Available: Unknown

The risk posed by CVE-2026-33540 is elevated due to the potential for credential exfiltration in containerized environments. Security teams must prioritize upgrading to version 3.1.0 immediately to remediate the underlying logic flaw and prevent the leakage of registry access tokens.