The oras-go Go library for managing OCI artifacts contains an SSRF vulnerability (CWE-918) in the blobStore.completePushAfterInitialPost function within registry/remote/repository.go. Before version 2.6.1, the library blindly follows a Location header controlled by the registry during a monolithic blob upload process. It also reuses the Authorization header from the initial POST request when issuing the subsequent PUT request. This combination allows a malicious registry to redirect the PUT request to an attacker-controlled host and receive the caller's credentials. This vulnerability is addressed in oras-go version 2.6.1.

An attacker controlling a malicious registry can exploit this SSRF vulnerability to redirect requests to arbitrary hosts and capture sensitive Authorization headers, leading to credential disclosure. The vulnerability does not affect integrity or availability but has a high confidentiality impact as it can leak credentials without requiring user interaction or privileges.

Upgrade to oras-go version 2.6.1 or later, where this SSRF vulnerability is fixed. Since the vendor advisory does not provide other remediation levels or temporary fixes, applying the official patch version is the recommended action. Patch status is confirmed by the version update information.