CVE-2026-48978
Received Received - Intake

Server-Side Request Forgery in oras-go

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-18
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-48978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oras_project oras-go to 2.6.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in oras-go, a Go library for managing OCI artifacts. It allows a malicious registry to cause Server-Side Request Forgery (SSRF) by redirecting auth.Client to internal networks or downgrading HTTPS to HTTP for token endpoints. This happens because the library follows realm URLs without validating the scheme or host.

Detection Guidance

This vulnerability involves SSRF via improper handling of WWW-Authenticate Bearer challenges in oras-go versions before 2.6.1. Detection requires checking if your system uses affected oras-go versions in Go applications. Inspect Go module dependencies for oras-go and verify version numbers. No specific commands are provided in the context to detect active exploitation.

Impact Analysis

An attacker could exploit this to access internal services like http://169.254.169.254/, http://10.0.0.x/, or http://127.0.0.1/. They could also downgrade secure HTTPS connections to unencrypted HTTP, potentially exposing sensitive data or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Exposure of sensitive data or credentials may result in compliance breaches.

Mitigation Strategies

Upgrade oras-go to version 2.6.1 or later to address the SSRF vulnerability. Review and update any Go applications using oras-go to ensure they use the patched version. Monitor network traffic for unusual internal or localhost requests as a potential sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart