A high-severity improper access control flaw in Distribution allows unauthenticated attackers to regain read access to deleted container blobs, posing a significant risk to data confidentiality.

This vulnerability is an improper access control issue where the delete path fails to fully clear repo-scoped membership, allowing deleted data to be recovered via a later Stat or Get request. The vulnerability is exploitable by unauthenticated remote attackers when specific Redis caching and deletion settings are enabled.

The ability for unauthorized parties to access supposedly deleted container content can lead to the exposure of sensitive proprietary code, configuration secrets, or intellectual property. With a CVSS score of 7.5, this vulnerability represents a significant risk to organizational confidentiality and regulatory compliance, particularly in environments managing private container images.

Immediate Action: Update the Distribution toolkit to version 3.1.0 or later to ensure the access control logic correctly purges blob descriptors.

Proactive Monitoring: Review repository access logs for anomalous Stat or Get requests targeting blobs that were previously marked for deletion.

Compensating Controls: If immediate patching is not feasible, consider disabling the storage cache or restricting access to the affected repositories to minimize the exposure window.

Public Exploit Available: No confirmed public exploit (weaponized or published PoC) is available in the current data; the CISA SSVC assessment indicates a proof-of-concept exists, but it has not been publicly disseminated.

Given the potential for unauthorized data access and the confirmed presence of a proof-of-concept, this vulnerability should be prioritized for remediation. Organizations utilizing Distribution with Redis caching must upgrade to version 3.1.0 immediately to prevent potential data leakage and ensure the integrity of their container storage workflows.