CVE-2026-50151

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
oras-project	oras-go	< 2.6.1

References

https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991Patch
https://github.com/oras-project/oras-go/pull/1152Issue Tracking, Patch
https://github.com/oras-project/oras-go/releases/tag/v2.6.1Release Notes
https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory
https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 17, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-501529.1Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the M CVE-2026-501576.5Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() an CVE-2026-501587.7yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-con CVE-2026-501595.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid CVE-2026-50167.3A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the component URL Handle CVE-2026-5016010.0Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthen CVE-2026-501619.3libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() fun CVE-2026-501626.9oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel c CVE-2026-501637.1oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink tar CVE-2026-501657.1alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in CVE-2026-501665.5Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12 CVE-2026-501675.3Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and