CVE-2026-48978 — oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Affected: oras-project oras-go

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

GHSA-vh4v-2xq2-g5cg — ORAS Go forwards registry credentials across registry redirects

Affected: Go: oras.land/oras-go/v2

# ORAS Go forwards registry credentials across registry redirects

Reporter / public credit: JUNYI LIU

## Summary

ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects.

There are two related paths:

1. A manifest or metadata request authenticates to the origin registry, then the origin returns a redirect to another host or port. The redirected request can carry the origin `Authorization` header to the redirect target. 2. A blob upload `POST` authenticates to the origin registry, then the origin returns an upload `Location` on another host or port. The follow-up `PUT` can carry the origin `Authorization` header to the `Location` target.

The upload `Location` issue appears related to the existing public fix in pull request #1152 / GHSA-jxpm-75mh-9fp7. The manifest redirect path is a residual adjacent route: the v2 branch after the upload `Location` fix still forwards Basic credentials on an authenticated manifest redirect.

## Impact

A registry response can cause an ORAS Go or ORAS CLI client to send configured registry credentials to an unintended endpoint. In common workflows, those credentials may come from a registry config / Docker-style auth file rather than command-line flags.

This is a credential exposure across the registry-origin boundary. I am not claiming remote code execution, registry compromise, arbitrary token theft, or live third-party impact.

## Affected Versions Tested

- `oras…

Most recent entries from all

CVE-2026-48978 — oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

GHSA-vh4v-2xq2-g5cg — ORAS Go forwards registry credentials across registry redirects