A local cache registry is exposed on all network interfaces without any authentication, and it allows delete operations. This weakness means that any host that can reach the registry can remove images or other artifacts stored there, potentially disrupting deployments, destroying build artifacts, or removing critical images needed for service availability. The flaw is a classic authentication failure (CWE-306) and can be leveraged to tamper with the integrity and availability of container images or related assets.

The vulnerability is present in oc-mirror release 4.21, which is the embedded local cache registry component used in that release. No other vendor, product, or version information is provided beyond the oc-mirror 4.21 release.

The CVSS score of 7.1 denotes medium severity. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network-based one: an attacker with network access to the host hosting the registry can connect on the exposed port, authenticate as none, and send HTTP DELETE requests. No specific exploit code is cited, but the lack of authentication makes the vulnerability trivial to exploit if the registry is reachable from untrusted networks.