VYPR
← All advisories
Low severityNVD Advisory· Published Jul 17, 2026· Updated Jul 23, 2026

CVE-2026-48978

CVE-2026-48978

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
oras.land/oras-go/v2Go
< 2.6.12.6.1
oras.land/oras-goGo
<= 1.2.7—

Affected products

333

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.