CVE-2026-50151CWE-918ssrf

CVE-2026-50151

High · published July 18, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-18T00:17Z
Affected products (1)
ProductVersionsFixed in
linuxfoundation/oras< 2.6.12.6.1
References (5)
https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991 · [email protected]https://github.com/oras-project/oras-go/pull/1152 · [email protected]https://github.com/oras-project/oras-go/releases/tag/v2.6.1 · [email protected]https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7 · [email protected]https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUL 19:41Z
    oras-go: credential forwarding via unvalidated Location header in blob upload
    cvelistv5