CVE-2026-33540

OVERVIEW CVE-2026-33540 is a credential disclosure vulnerability affecting Docker Distribution versions prior to 3.1.0. The flaw exists in pull-through cache mode, where the application parses WWW-Authenticate bearer challenge responses from upstream registries to discover token authentication endpoints. The vulnerability occurs because the realm URL extracted from these challenges is used without validation of its origin, allowing an attacker controlling the upstream registry or positioned on the network path to redirect credentials to malicious endpoints. SEVERITY This vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no special privileges or user interaction. The attack complexity is low, making it relatively straightforward to exploit. The impact is limited to confidentiality breach—specifically the disclosure of configured upstream credentials via basic authentication—with no direct impact to integrity or availability. The FAUCET risk score of 48.0 indicates moderate concern within the broader threat landscape. EXPLOITATION STATUS Currently, there is no evidence of active exploitation, with the vulnerability marked as inactive on KEV catalogs and absent from active exploit databases. The low EPSS score of 0.00037 suggests minimal real-world exploitation activity relative to other disclosed vulnerabilities. However, organizations running Distribution versions prior to 3.1.0 should prioritize patching to prevent credential compromise in environments where upstream registry compromise or network interception is a realistic threat.