Skip to content
OpenAdvisories

Vendor

oras-project

7 known vulnerabilities.

Products

oras-go 6 oras 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.1
    CVE-2026-48978

    oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to int…

    oras-project oras-go kubescape kots Debian Ubuntu Wolfi Go