Findings

CVE-2026-85747

Distribution: Client does not verify returned content against requested digest

Published Oct 15, 2026 · updated Oct 15, 2026

### Summary fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pull-through caches — is silently undermined. The bundled pull-through proxy ( ) is itself an unguarded consumer and is directly exploitable. ### Details **Root cause:** reads the response body and passes it directly to without ever computing and comparing against the caller-supplied . The response header is parsed (lines 251-292 in ) only to populate an out-parameter ( ) and is itself server-supplied — it is never recomputed from the body, so a lying server can set it to whatever value the caller requested while delivering different bytes. **Attack path:** An attacker who controls the registry endpoint (malicious registry, compromised upstream, DNS hijack, or TLS MITM) responds to with: 1. (forged header) 2. A body containing a different, attacker-chosen manifest The client calls on the substituted body, returns the attacker's manifest as if it were the pinned content, and the caller has no way to detect the substitution. **Why it matters:** The entire value of digest pinning is to guarantee content-addressable integrity against exactly this threat model (hostile or MITM server). The pull-through cache calls and immediately writes the result to local storage with no re-verification — so a poisoned remote can permanently inject a bad manifest into the mirror cache, affecting all subsequent consumers. Relevant code path ( , simplified): ### PoC **go.mod:** **main.go:** **Output (v2.8.3+incompatible):** ### Impact Any application that calls with a digest argument — and relies on that digest to guarantee which image conten