https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:26:45 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 https://cve.radiocsirt.org/vuln/euvd-2026-339084 EUVD-2026-339084 https://cve.radiocsirt.org/vuln/euvd-2026-339084 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48978 <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry&#39;s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry&#39;s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48978 https://cve.radiocsirt.org/vuln/ghsa-xf85-363p-868w <p><strong>Affected:</strong> Go: oras.land/oras-go/v2, Go: oras.land/oras-go</p> <p>## Summary</p> <p>oras-go&#39;s `auth.Client` follows the `realm` URL from a registry&#39;s `WWW-Authenticate: Bearer` challenge without validating its scheme or host. The `realm` field is server-controlled by design in the OCI/distribution spec — registries legitimately point token requests at a separate auth endpoint (e.g. Docker Hub&#39;s `registry-1.docker.io` -&gt; `auth.docker.io`), so cross-host realms on public DNS names are not in themselves a vulnerability. Two specific patterns, however, are never legitimate under any registry trust model and can be abused by a malicious or compromised registry (or a man-in-the-middle on a plaintext connection):</p> <p>1. **SSRF to internal networks.** A realm of `http://169.254.169.254/...` (AWS/Azure IMDS), `http://10.0.0.x/...` (RFC 1918), or `http://127.0.0.1/...` causes oras-go running on a cloud VM or corporate workstation to issue outbound HTTP requests from inside the user&#39;s trust boundary to an endpoint the user did not choose. The user&#39;s stored credentials are attached to those requests, but the principal harm is the network primitive — probing internal endpoints from the client. On IMDSv1 the response body is recoverable from log channels; on IMDSv2 the probe itself can still be used for service discovery.</p> <p>2. **TLS downgrade.** A registry contacted over `https://` can return a realm with an `http://` scheme, causing oras-go to send the user&#39;s credentials over plaintext to the token endpoint. This defeats the transport security the user chose whe…</p> <p><strong>Affected:</strong> Go: oras.land/oras-go/v2, Go: oras.land/oras-go</p> <p>## Summary</p> <p>oras-go&#39;s `auth.Client` follows the `realm` URL from a registry&#39;s `WWW-Authenticate: Bearer` challenge without validating its scheme or host. The `realm` field is server-controlled by design in the OCI/distribution spec — registries legitimately point token requests at a separate auth endpoint (e.g. Docker Hub&#39;s `registry-1.docker.io` -&gt; `auth.docker.io`), so cross-host realms on public DNS names are not in themselves a vulnerability. Two specific patterns, however, are never legitimate under any registry trust model and can be abused by a malicious or compromised registry (or a man-in-the-middle on a plaintext connection):</p> <p>1. **SSRF to internal networks.** A realm of `http://169.254.169.254/...` (AWS/Azure IMDS), `http://10.0.0.x/...` (RFC 1918), or `http://127.0.0.1/...` causes oras-go running on a cloud VM or corporate workstation to issue outbound HTTP requests from inside the user&#39;s trust boundary to an endpoint the user did not choose. The user&#39;s stored credentials are attached to those requests, but the principal harm is the network primitive — probing internal endpoints from the client. On IMDSv1 the response body is recoverable from log channels; on IMDSv2 the probe itself can still be used for service discovery.</p> <p>2. **TLS downgrade.** A registry contacted over `https://` can return a realm with an `http://` scheme, causing oras-go to send the user&#39;s credentials over plaintext to the token endpoint. This defeats the transport security the user chose whe…</p> https://cve.radiocsirt.org/vuln/ghsa-xf85-363p-868w https://cve.radiocsirt.org/vuln/opensuse-su-2026:11186-1 <p>helm-4.2.2-2.1 on GA media</p> <p>helm-4.2.2-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11186-1 https://cve.radiocsirt.org/vuln/suse-su-2026:22603-1 <p>Security update for helm</p> <p>Security update for helm</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22603-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48978 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry&#39;s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry&#39;s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48978