CVE-2026-48978: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Deferred

AliasesSUSE-SU-2026:22603-1SUSE-SU-2026:22650-1UBUNTU-CVE-2026-48978+667 more

Published 17-07-2026Last modified 21-07-2026

Vulnerability summary

CVE-2026-48978 is a low (CVSS 2.1) vulnerability in oras-project oras-go. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.1/10

010

Low · v4.0 (CVE.org)

EPSS score

0.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 16

OPENSUSE-SU-2026:21551-1 OPENSUSE-SU-2026:21809-1 OPENSUSE-SU-2026:21983-1 SUSE-SU-2026:23052-1 SUSE-SU-2026:23162-1 SUSE-SU-2026:23216-1+10 more

Timeline

17-07-2026
PublishedVulnerability first disclosed.
21-07-2026
Last modifiedVulnerability information updated.

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

CVSS metrics

7 scores · 7 sources · 1 version

v4.02.1

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r5

argo-cd-3.2-compat< 3.2.12-r5
argo-cd-3.3< 3.3.12-r3
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-3.4< 3.4.4-r2
argo-cd-3.4-compat< 3.4.4-r2
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r14
argo-cd-fips-3.1-compat< 3.1.16-r14
argo-cd-fips-3.2< 3.2.12-r9
argo-cd-fips-3.2-compat< 3.2.12-r9
argo-cd-fips-3.3< 3.3.12-r4
argo-cd-fips-3.3-compat< 3.3.12-r4
argo-cd-fips-3.4< 3.4.4-r3
argo-cd-fips-3.4-compat< 3.4.4-r3
argocd-image-updater< 1.2.2-r2
argocd-image-updater-fips< 1.2.2-r1
cert-manager-cmctl< 2.5.0-r9
cert-manager-cmctl-fips< 2.5.0-r5
chaos-mesh< 2.8.3-r4
chaos-mesh-fips< 2.8.3-r3
chartmuseum< 0.16.5-r16
chartmuseum-fips< 0.16.5-r15
cilium-cli< 0.19.5-r1
cloudbeat-8.17< 8.17.10-r29
cloudbeat-9.0< 9.0.8-r31
cloudbeat-9.1< 9.1.10-r24
cloudbeat-9.2< 9.2.8-r13
cloudbeat-fips-8.17< 8.17.10-r34
cloudbeat-fips-9.0< 9.0.8-r35
cloudbeat-fips-9.1< 9.1.10-r27
cloudbeat-fips-9.2< 9.2.8-r10
cluster-api-helm-controller< 0.6.4-r9
cluster-api-helm-controller-fips< 0.6.4-r8
commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-19.5All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.5All versions (No fix recorded)
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.13All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.13All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.13All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyvernopre-1.13All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
conftest< 0.68.2-r5
conftest-fips< 0.68.2-r7
consul-k8s-1.1-cli< 1.1.18-r41
consul-k8s-1.3-cli< 1.3.9-r47
consul-k8s-1.4-cli< 1.4.10-r33
consul-k8s-1.5-cli< 1.5.9-r31
consul-k8s-1.6-cli< 1.6.10-r25
consul-k8s-1.7-cli< 1.7.13-r15
consul-k8s-1.9-cli< 1.9.9-r1
consul-k8s-2.0-cli< 2.0.1-r2
consul-k8s-fips-1.1-cli< 1.1.18-r40
consul-k8s-fips-1.3-cli< 1.3.9-r43
consul-k8s-fips-1.4-cli< 1.4.10-r32
consul-k8s-fips-1.5-cli< 1.5.9-r33
consul-k8s-fips-1.6-cli< 1.6.10-r26
consul-k8s-fips-1.7-cli< 1.7.13-r17
consul-k8s-fips-1.9-cli< 1.9.9-r2
consul-k8s-fips-2.0-cli< 2.0.1-r3
crossplane-2.3-crank< 2.3.3-r5
crossplane-fips-2.3-crank< 2.3.3-r3
drone< 3.3.0-r8
drone-fips< 3.3.0-r8
eksctl< 0.229.0-r1
envoy-gateway-1.5-egctl< 1.5.9-r1
envoy-gateway-1.6-egctl< 1.6.7-r1
envoy-gateway-1.7-egctl< 1.7.4-r1
envoy-gateway-fips-1.5-egctl< 1.5.9-r1
envoy-gateway-fips-1.6-egctl< 1.6.7-r1
envoy-gateway-fips-1.7-egctl< 1.7.4-r1
falcoctl< 0.13.0-r10
falcoctl-fips< 0.13.0-r8
falcoctl-fips-0.4All versions (No fix recorded)
gatekeeper-3.20-gatorAll versions (No fix recorded)
gatekeeper-3.21-gatorAll versions (No fix recorded)
gatekeeper-3.22-gator< 3.22.2-r7
gitlab-operator< 3.1.1-r1
gitlab-operator-fips< 3.1.1-r1
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded)
gitlab-rails-ce-19.1All versions (No fix recorded)
gitlab-rails-ce-19.2All versions (No fix recorded)
gitlab-rails-ce-19.3All versions (No fix recorded)
gitlab-rails-ce-19.4All versions (No fix recorded)
gitlab-rails-ce-19.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-fips-19.2All versions (No fix recorded)
gitlab-rails-ce-fips-19.3All versions (No fix recorded)
gitlab-rails-ce-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-fips-19.5All versions (No fix recorded)
gitness< 3.3.0-r25
gogatekeeper< 4.10.0-r2
harvester< 1.8.1-r11
harvester-fips< 1.8.1-r11
harvester-fips-webhook< 1.8.1-r11
harvester-webhook< 1.8.1-r11
headlamp< 0.43.0-r3
headlamp-fips< 0.43.0-r5
helm-3< 3.22.0-r0
helm-exporter< 1.3.0-r14
helm-exporter-fips< 1.3.0-r14
helm-mapkubeapis< 0.6.1-r22
helm-operator< 1.42.3-r1
helm-operator-fips< 1.42.3-r2
helm-push< 0.11.1-r17
helm-set-status< 0.3.0-r22
jfrog-cli< 2.112.0-r0
k8sgptAll versions (No fix recorded) | < 0.4.36-r1
k8ssandra-client< 0.8.14-r2 | < 0.9.1-r2
k8ssandra-client-fips< 0.8.14-r1
k9s< 0.51.0-r5
k9s-fips< 0.51.0-r4
kargo< 1.10.8-r2
kgateway-2.3< 2.3.5-r3
kgateway-fips-2.3< 2.3.5-r2
kots< 1.130.6-r2
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r14
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r8
kube-mgmt< 11.0.7-r6
kube-mgmt-fips< 11.0.7-r8
kubescape< 4.0.10-r3
kubescape-operator< 0.2.172-r2 | All versions (No fix recorded) | < 0.2.151-r4
kubescape-operator-fips< 0.2.151-r6
kubescape-server< 4.0.10-r3
kubescape-server-downloader< 4.0.10-r3
kubescape-server-fips< 4.0.10-r4
kubescape-server-fips-downloader< 4.0.10-r4
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kyverno-1.14All versions (No fix recorded)
kyverno-1.15< 1.15.3-r24
kyverno-1.16< 1.16.4-r12
kyverno-1.17< 1.17.2-r35 | All versions (No fix recorded)
kyverno-1.18< 1.18.1-r11
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15< 1.15.3-r24
kyverno-background-controller-1.16< 1.16.4-r12
kyverno-background-controller-1.17< 1.17.2-r17
kyverno-background-controller-1.18< 1.18.1-r11
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15< 1.15.20-r9
kyverno-background-controller-fips-1.16< 1.16.4-r11
kyverno-background-controller-fips-1.17< 1.17.2-r12
kyverno-background-controller-fips-1.18< 1.18.2-r3
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15< 1.15.3-r24
kyverno-cleanup-controller-1.16< 1.16.4-r12

Show all 200

1 vendor · 200 products · Showing 200 of 436

References

13 links

github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868wX Refsource CONFIRMREPORTAdvisoryWEB
github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764X Refsource MISCFIXWEB
github.com/oras-project/oras-go/releases/tag/v2.6.1X Refsource MISCWEB
www.suse.com/support/update/announcement/2026/suse-su-202622603-1/Advisory
bugzilla.suse.com/1270127REPORT
www.suse.com/security/cve/CVE-2026-48978WEB
www.suse.com/support/update/announcement/2026/suse-su-202622650-1/Advisory
ubuntu.com/security/CVE-2026-48978REPORT
www.cve.org/CVERecord?id=CVE-2026-48978REPORT
security-tracker.debian.org/tracker/CVE-2026-48978Advisory

Show all 13 references