CVE-2026-48978
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
| CWE | CWE-918 CWE-319 |
| Vendor | oras-project |
| Product | oras-go |
| Published | Jul 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for oras-project oras-go
Be the first to know when new unknown vulnerabilities affecting oras-project oras-go are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
oras-project / oras-go
< 2.6.1