CVE-2026-50151: CWE-918: Server-Side Request Forgery (SSRF) in oras-project oras-go
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
AI Analysis
Technical Summary
The oras-go Go library for managing OCI artifacts contains an SSRF vulnerability (CWE-918) in the blobStore.completePushAfterInitialPost function within registry/remote/repository.go. Before version 2.6.1, the library follows a Location header controlled by the registry during a monolithic blob upload and reuses the Authorization header from the initial POST request in the subsequent PUT request. This behavior enables a malicious registry to redirect the PUT request to an attacker-controlled host, thereby exposing the caller's credentials to that host. This vulnerability is addressed in oras-go version 2.6.1.
Potential Impact
An attacker controlling a malicious registry can exploit this vulnerability to receive the Authorization credentials of the client by redirecting the PUT request to an attacker-controlled endpoint. This leads to credential exposure (confidentiality impact) but does not affect integrity or availability. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
Mitigation Recommendations
Upgrade to oras-go version 2.6.1 or later, where this SSRF vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in version 2.6.1.
CVE-2026-50151: CWE-918: Server-Side Request Forgery (SSRF) in oras-project oras-go
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The oras-go Go library for managing OCI artifacts contains an SSRF vulnerability (CWE-918) in the blobStore.completePushAfterInitialPost function within registry/remote/repository.go. Before version 2.6.1, the library follows a Location header controlled by the registry during a monolithic blob upload and reuses the Authorization header from the initial POST request in the subsequent PUT request. This behavior enables a malicious registry to redirect the PUT request to an attacker-controlled host, thereby exposing the caller's credentials to that host. This vulnerability is addressed in oras-go version 2.6.1.
Potential Impact
An attacker controlling a malicious registry can exploit this vulnerability to receive the Authorization credentials of the client by redirecting the PUT request to an attacker-controlled endpoint. This leads to credential exposure (confidentiality impact) but does not affect integrity or availability. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
Mitigation Recommendations
Upgrade to oras-go version 2.6.1 or later, where this SSRF vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in version 2.6.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-03T20:54:20.431Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b5eb02d1edb114c7fb34a
Added to database: 07/18/2026, 11:08:32 UTC
Last enriched: 07/18/2026, 11:54:24 UTC
Last updated: 07/18/2026, 13:13:21 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.