CVE-2026-48978
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.
Risk Assessment
The risk is the possibility of an SSRF attack that could expose sensitive data from internal network resources, such as cloud metadata.
Recommendation
It is recommended to immediately update oras-go to version 2.6.1 or later.
Original NVD description (English source)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.