CVE-2026-50151
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.
Risk Assessment
Risk of credential leakage to an attacker-controlled endpoint, potentially leading to unauthorized access to OCI registries and associated resources.
Recommendation
Update oras-go to version 2.6.1 or later, and ensure the client does not trust Location headers from untrusted registries.
Other vulnerabilities in oras-go
See all- GHSA-vh4v-2xq2-g5cgMedium
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
- CVE-2026-50163High
Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.
- CVE-2026-50162Medium
oras-go before version 2.6.1 has a vulnerability in resolveWritePath() that does not account for symlink traversal. This allows an attacker to bypass AllowPathTraversalOnWrite=false and write files outside the working directory via a controlled blob title.
- CVE-2026-48978Low
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
Original NVD description (English source)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.