VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 17, 2026· Updated Aug 26, 2026

CVE-2026-50151

CVE-2026-50151

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
oras.land/oras-go/v2Go
< 2.6.12.6.1

Affected products

326

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.