Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M
CVE-2026-48978oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
Low 2.1
In plain English
A low-severity server-side request forgery in oras-go from oras-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-oras-oras-go | no fix listed | DEBIAN-CVE-2026-48978 |
| Debian:13 | golang-oras-oras-go | no fix listed | DEBIAN-CVE-2026-48978 |
| Debian:14 | golang-oras-oras-go | 2.6.2-1 | DEBIAN-CVE-2026-48978 |
| Go | oras.land/oras-go | no fix listed | GHSA-xf85-363p-868w |
| Go | oras.land/oras-go/v2 | 2.6.1 | GHSA-xf85-363p-868w |
| Go | oras.land/oras-go/v2 | 2.6.1 | GO-2026-5885 |
| Ubuntu:24.04:LTS | golang-oras-oras-go | no fix listed | UBUNTU-CVE-2026-48978 |
| Ubuntu:26.04:LTS | golang-oras-oras-go | no fix listed | UBUNTU-CVE-2026-48978 |
| Ubuntu:26.10 | golang-oras-oras-go | no fix listed | UBUNTU-CVE-2026-48978 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| oras-project | oras-go | < 2.6.1 |
Weakness: CWE-918, CWE-319 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N