CVE-2026-48978 Details
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
A server-side request forgery (SSRF) vulnerability has been identified in the Oras-Go library, specifically in versions prior to 2.6.1. The issue arises because the auth.Client component does not properly validate the scheme or host of the realm URL provided by a registry's WWW-Authenticate: Bearer challenge. This oversight allows a malicious or compromised registry to redirect internal network requests to sensitive endpoints, such as cloud metadata services or localhost, while also potentially downgrading secure HTTPS connections to HTTP. The vulnerability is particularly concerning as it can be exploited to probe internal networks or intercept credentials sent over unencrypted channels.
Users can upgrade to Oras-Go version 2.6.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764 | [email protected] | Source CodeVendor |
| https://github.com/oras-project/oras-go/releases/tag/v2.6.1 | [email protected] | Release NotesVendor |
| https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oras-project oras-go | <v2.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |