CVE-2026-61833

COMPONENT VERSION RANGE

NewScan fingerprints zot from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-19 (/daily-cve). Version-gated on the tech_signatures "zot" row added in the same batch, which reads releaseTag out of GET /v2/_zot/ext/mgmt (see that row for the measurement). `lt 2.1.18` follows the advisory's own words - GHSA-qg67-7m6v-qg25 states affected as "prior to 2.1.18" and names 2.1.18 as the fix - so the bound is stated, not inferred. Two-component builds only: zot tags are x.y.z with no fourth component, so `lt` compares cleanly and the four-component trap in docs/signature-packs.md does not apply here. NEGATIVE CASE MEASURED: the image this row was written against reports 2.1.21, which is above the bound, so the shipped fingerprint on a current zot must NOT produce this finding - that is the arm a wrong `lt` would fail. Version-match only: proving the bypass would mean forging a bearer token against someone else's registry. Reachability, because it bounds the row: the version document is served only while http.auth is empty (a zot with htpasswd configured answers that route 404), so this row fires on the exposed registries the scanner is pointed at and stays silent on a locked-down one.