CVE-2026-48978

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

CVSS Metrics

• v4.0•LOW•Score: 2.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
• v4.0•LOW•Score: 2.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.26%• Percentile: 18%

Techniques & Countermeasures

• CWE-319•Cleartext Transmission of Sensitive Information

  The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

• CWE-918•Server-Side Request Forgery (SSRF)

  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Systems

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  all

• chainguard•argo-cd-3.1-compat

  all

• chainguard•argo-cd-3.2

  < 3.2.12-r5

• chainguard•argo-cd-3.2-compat

  < 3.2.12-r5

• chainguard•argo-cd-3.3

  < 3.3.12-r3

• chainguard•argo-cd-3.3-compat

  all

• chainguard•argo-cd-3.4

  < 3.4.4-r2

• chainguard•argo-cd-3.4-compat

  < 3.4.4-r2

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  all | < 3.1.16-r14

• chainguard•argo-cd-fips-3.1-compat

  all | < 3.1.16-r14

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r9

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r9

• chainguard•argo-cd-fips-3.3

  < 3.3.12-r4

• chainguard•argo-cd-fips-3.3-compat

  < 3.3.12-r4

• chainguard•argo-cd-fips-3.4

  < 3.4.4-r3

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.4-r3

• chainguard•argocd-image-updater

  < 1.2.2-r2

• chainguard•argocd-image-updater-fips

  < 1.2.2-r1

• chainguard•cert-manager-cmctl

  < 2.5.0-r9

• chainguard•cert-manager-cmctl-fips

  < 2.5.0-r5

• chainguard•chaos-mesh

  < 2.8.3-r4

• chainguard•chaos-mesh-fips

  < 2.8.3-r3

• chainguard•chartmuseum

  < 0.16.5-r16

• chainguard•chartmuseum-fips

  < 0.16.5-r15

• chainguard•cilium-cli

  < 0.19.5-r1

• chainguard•cloudbeat-8.17

  < 8.17.10-r29

• chainguard•cloudbeat-9.0

  < 9.0.8-r31

• chainguard•cloudbeat-9.1

  < 9.1.10-r24

• chainguard•cloudbeat-9.2

  < 9.2.8-r13

• chainguard•cloudbeat-fips-8.17

  < 8.17.10-r34

• chainguard•cloudbeat-fips-9.0

  < 9.0.8-r35

• chainguard•cloudbeat-fips-9.1

  < 9.1.10-r27

• chainguard•cloudbeat-fips-9.2

  < 9.2.8-r10

• chainguard•cluster-api-helm-controller

  < 0.6.4-r9

• chainguard•cluster-api-helm-controller-fips

  < 0.6.4-r8

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•commercial-kyverno-1.13

  all

• chainguard•commercial-kyverno-1.14

  all

• chainguard•commercial-kyverno-1.15

  all

• chainguard•commercial-kyverno-1.16

  all

• chainguard•commercial-kyverno-1.17

  all

Showing first 50 affected entries in server-rendered view.

References (13)

• https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w
• https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764
• https://github.com/oras-project/oras-go
• https://github.com/oras-project/oras-go/releases/tag/v2.6.1
• https://www.suse.com/support/update/announcement/2026/suse-su-202622603-1/
• https://bugzilla.suse.com/1270127
• https://www.suse.com/security/cve/CVE-2026-48978
• https://www.suse.com/support/update/announcement/2026/suse-su-202622650-1/
• https://ubuntu.com/security/CVE-2026-48978
• https://www.cve.org/CVERecord?id=CVE-2026-48978
• https://security-tracker.debian.org/tracker/CVE-2026-48978
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48978.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-48978