ORAS Go forwards the Authorization header containing registry credentials to redirected HTTP origins during two flows: manifest or metadata requests that receive a redirect response, and blob upload POST requests that receive an upload Location on a different host or port. In affected versions, the client sends the original registry credentials to the redirected endpoint, violating the security invariant that credentials should not be forwarded across registry-origin boundaries. This was tested and confirmed in oras-go v2.6.0 and related commits. The upload Location path was partially fixed in the v2 branch, but the manifest redirect path remains vulnerable. The ORAS CLI using oras-go v2.6.0 is also affected when using registry config files for authentication.

Credentials configured for one registry origin can be exposed to unintended endpoints due to forwarding during HTTP redirects or upload Location responses. This leads to credential leakage across origin boundaries. There is no evidence of remote code execution, registry compromise, or arbitrary token theft. The impact is limited to credential exposure, which could be leveraged by an attacker controlling the redirect target to capture sensitive authentication data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using registry configurations that contain sensitive credentials with ORAS Go versions prior to 2.6.1 when interacting with registries that may issue redirects to different origins. Monitor vendor communications for updates and apply official patches once released.