Linuxfoundation Oras vulnerabilities

1 vulnerability

Known vulnerabilities in Linuxfoundation Oras, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

PrioritiseCVE-2026-50151oras-project · oras-go +414 moreoras-go: credential forwarding via unvalidated Location header in blob uploadoras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.CVSS7.5HighEPSS0.38%