VDB
GO-2025-3460
GO-2025-3460
PUBLISHED
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | harbor-fips-2.13 | *, *, * |
| chainguard | kots | 0, 0, 0 |
| chainguard | zot | 0, 0, 0 |
| github.com | distribution/distribution | 0, 0 |
| chainguard | harbor-fips-2.12 | 0, 0, 0 |
| chainguard | harbor-fips-2.15 | *, *, * |
| chainguard | harbor-2.15 | *, *, * |
| wolfi | harbor-2.14 | *, *, * |
| chainguard | harbor-2.12 | 0, 0, 0 |
| chainguard | harbor-2.14 | *, *, * |
| wolfi | kots | 0, 0, 0 |
| chainguard | harbor-2.13 | *, *, * |
| wolfi | zot | 0, 0, 0 |
| chainguard | harbor-fips-2.14 | *, *, * |
Timeline
- Mar 3, 2025 CVE Published
- Feb 4, 2026 CVE Updated
- May 18, 2026 Security Advisory