Affected by GO-2025-3460
and 2 other vulnerabilities
GO-2025-3460: Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
GO-2026-5094: Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
GO-2026-5185: Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
The templates are passed in the api/v2.APIDescriptor object. Please see the
package documentation for fields available on that object. The template
syntax is from Go's standard library text/template package. For information
on Go's template syntax, please see golang.org/pkg/text/template.