CVE-2026-33540

A flaw was found in Distribution, a toolkit for managing container content. When operating in pull-through cache mode, Distribution incorrectly processes authentication challenges from an upstream registry. An attacker controlling the upstream registry, or positioned as a Man-in-the-Middle (MitM), can exploit this by providing a malicious authentication realm URL. This vulnerability can cause Distribution to send sensitive upstream credentials, via basic authentication, to an attacker-controlled server, leading to information disclosure.