Hi,

The following vulnerability was published for docker-registry.

CVE-2026-41888[0]:
| Distribution is a toolkit to pack, ship, store, and deliver
| container content. Prior to 3.1.1, tag deletion via the DELETE
| /v2/<name>/manifests/<tag> endpoint bypasses the
| storage.delete.enabled: false configuration, allowing any API client
| to remove tags from repositories even when the operator has
| explicitly disabled deletion. This vulnerability is fixed in 3.1.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-41888
https://www.cve.org/CVERecord?id=CVE-2026-41888
[1] https://github.com/distribution/distribution/security/advisories/GHSA-6pjf-3r9x-m592
[2] https://github.com/distribution/distribution/commit/8baf3e08266a19590cc5d4725f3976a9a876d4bf

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore