CVE-2026-50151 | oras-go is a Go library for managing OCI artifacts. Prior to… | CVSS 7.5 HIGH

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Metadata

CVE ID: CVE-2026-50151
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-03 20:54 UTC
Published: 2026-07-17 19:41 UTC
Last updated: 2026-07-17 19:41 UTC
Primary CWE: CWE-918
CWE-918: Server-Side Request Forgery (SSRF)
Vendor / Product: oras-project / oras-go
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
oras-project	oras-go	—	< 2.6.1

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	CWE-918: Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (4)

https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7 https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7
https://github.com/oras-project/oras-go/pull/1152 https://github.com/oras-project/oras-go/pull/1152
https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991 https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991
https://github.com/oras-project/oras-go/releases/tag/v2.6.1 https://github.com/oras-project/oras-go/releases/tag/v2.6.1