Zot's Dedupe Deception: How a Cache Feature Became an Authorization Bypass

Zot, an OCI image registry, contains a critical authorization bypass vulnerability in its blob deduplication feature. Prior to version 2.1.0, an authenticated attacker with access to a single repository could read any blob from any other repository on the same instance, provided they knew the blob's digest. The flaw stemmed from the global cache, which would happily serve up blobs without verifying if the user was authorized to access the blob's original source repository, effectively turning a storage optimization feature into a data exfiltration vector.