CVE-2026-50151highCWE-918

CVE-2026-50151: fallo de gravedad alta en oras-project oras-go

oras-go: credential forwarding via unvalidated Location header in blob upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear oras-go+ Monitorear golang-oras-oras-go

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.4%
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
oras-project · oras-go
CVEs relacionadas — oras-project oras-go

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-85731HIGHoras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)EPSS 0.7%CVE-2026-50162MEDIUMoras-go: file store write outside workingDir via symlink traversalEPSS 0.4%CVE-2026-50163HIGHoras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extractionEPSS 0.4%CVE-2026-85732MEDIUMoras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingEPSS 0.4%CVE-2026-48978LOWoras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensEPSS 0.2%