CVE-2026-50151
Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.38% probability · 32th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- linuxfoundation/oras
- Source
- security-advisories@github.com
References
- https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991Patch
- https://github.com/oras-project/oras-go/pull/1152Issue Tracking, Patch
- https://github.com/oras-project/oras-go/releases/tag/v2.6.1Release Notes
- https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory
- https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.