CVE-2026-50151: oras-go: credential forwarding via unvalidated Location header in blob upload

Analyzed

AliasesUBUNTU-CVE-2026-50151DEBIAN-CVE-2026-50151CGA-292p-c5f2-ccvm+621 more

Published 17-07-2026Last modified 20-07-2026

Vulnerability summary

CVE-2026-50151 is a high (CVSS 7.5) Server-Side Request Forgery vulnerability in linuxfoundation oras. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 15 · Related 16

OPENSUSE-SU-2026:11302-1 OPENSUSE-SU-2026:21395-1 OPENSUSE-SU-2026:21551-1 OPENSUSE-SU-2026:21809-1 OPENSUSE-SU-2026:21983-1 SUSE-SU-2026:23216-1+10 more

Timeline

17-07-2026
PublishedVulnerability first disclosed.
20-07-2026
Last modifiedVulnerability information updated.

Description

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Oras Go
Maturity: poc

Weaknesses

CWE · root cause

CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r5

argo-cd-3.2-compat< 3.2.12-r5
argo-cd-3.3< 3.3.12-r3
argo-cd-3.3-compat< 3.3.14-r9
argo-cd-3.4< 3.4.4-r2
argo-cd-3.4-compat< 3.4.4-r2
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r14
argo-cd-fips-3.1-compat< 3.1.16-r14
argo-cd-fips-3.2< 3.2.12-r9
argo-cd-fips-3.2-compat< 3.2.12-r9
argo-cd-fips-3.3< 3.3.12-r4
argo-cd-fips-3.3-compat< 3.3.12-r4
argo-cd-fips-3.4< 3.4.4-r3
argo-cd-fips-3.4-compat< 3.4.4-r3
argocd-image-updater< 1.2.2-r2
argocd-image-updater-fips< 1.2.2-r1
cert-manager-cmctl< 2.5.0-r9
cert-manager-cmctl-fips< 2.5.0-r5
chaos-mesh< 2.8.3-r4
chaos-mesh-fips< 2.8.3-r3
chartmuseum< 0.16.5-r16
chartmuseum-fips< 0.16.5-r15
cilium-cli< 0.19.5-r1
cloudbeat-8.17< 8.17.10-r29
cloudbeat-9.0< 9.0.8-r31
cloudbeat-9.1< 9.1.10-r24
cloudbeat-9.2< 9.2.8-r13
cloudbeat-fips-8.17< 8.17.10-r34
cloudbeat-fips-9.0< 9.0.8-r35
cloudbeat-fips-9.1< 9.1.10-r27
cloudbeat-fips-9.2< 9.2.8-r10
cluster-api-helm-controller< 0.6.4-r9
cluster-api-helm-controller-fips< 0.6.4-r8
commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-19.5All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.5All versions (No fix recorded)
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.13All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.13All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.13All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyvernopre-1.13All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
conftest< 0.68.2-r5
conftest-fips< 0.68.2-r7
consul-k8s-1.1-cli< 1.1.18-r41
consul-k8s-1.3-cli< 1.3.9-r47
consul-k8s-1.4-cli< 1.4.10-r33
consul-k8s-1.5-cli< 1.5.9-r31
consul-k8s-1.6-cli< 1.6.10-r25
consul-k8s-1.7-cli< 1.7.13-r15
consul-k8s-1.9-cli< 1.9.9-r1
consul-k8s-2.0-cli< 2.0.1-r2
consul-k8s-fips-1.1-cli< 1.1.18-r40
consul-k8s-fips-1.3-cli< 1.3.9-r43
consul-k8s-fips-1.4-cli< 1.4.10-r32
consul-k8s-fips-1.5-cli< 1.5.9-r33
consul-k8s-fips-1.6-cli< 1.6.10-r26
consul-k8s-fips-1.7-cli< 1.7.13-r17
consul-k8s-fips-1.9-cli< 1.9.9-r2
consul-k8s-fips-2.0-cli< 2.0.1-r3
crossplane-2.3-crank< 2.3.3-r5
crossplane-fips-2.3-crank< 2.3.3-r3
drone< 3.3.0-r8
drone-fips< 3.3.0-r8
eksctl< 0.229.0-r1
envoy-gateway-1.5-egctl< 1.5.9-r1
envoy-gateway-1.6-egctl< 1.6.7-r1
envoy-gateway-1.7-egctl< 1.7.4-r1
envoy-gateway-fips-1.5-egctl< 1.5.9-r1
envoy-gateway-fips-1.6-egctl< 1.6.7-r1
envoy-gateway-fips-1.7-egctl< 1.7.4-r1
falcoctl< 0.13.0-r10
falcoctl-fips< 0.13.0-r8
falcoctl-fips-0.4All versions (No fix recorded)
gatekeeper-3.21-gatorAll versions (No fix recorded)
gatekeeper-3.22-gator< 3.22.2-r7
gitlab-operator< 3.1.1-r1
gitlab-operator-fips< 3.1.1-r1
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.1All versions (No fix recorded)
gitlab-rails-ce-19.2All versions (No fix recorded)
gitlab-rails-ce-19.3All versions (No fix recorded)
gitlab-rails-ce-19.4All versions (No fix recorded)
gitlab-rails-ce-19.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-fips-19.2All versions (No fix recorded)
gitlab-rails-ce-fips-19.3All versions (No fix recorded)
gitlab-rails-ce-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-fips-19.5All versions (No fix recorded)
gitness< 3.3.0-r25
gogatekeeper< 4.10.0-r2
headlamp< 0.43.0-r3
headlamp-fips< 0.43.0-r5
helm-3< 3.22.0-r0
helm-exporter< 1.3.0-r14
helm-exporter-fips< 1.3.0-r14
helm-mapkubeapis< 0.6.1-r22
helm-operator< 1.42.3-r1
helm-operator-fips< 1.42.3-r2
helm-push< 0.11.1-r17
helm-set-status< 0.3.0-r22
jfrog-cli< 2.112.0-r0
k8ssandra-client< 0.8.14-r2 | < 0.9.1-r2
k8ssandra-client-fips< 0.8.14-r1
k9s< 0.51.0-r5
k9s-fips< 0.51.0-r4
kargo< 1.10.8-r2
kgateway-2.3< 2.3.5-r3
kgateway-fips-2.3< 2.3.5-r2
kots< 1.130.6-r2
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r14
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r8
kube-mgmt< 11.0.7-r6
kube-mgmt-fips< 11.0.7-r8
kubescape< 4.0.10-r3
kubescape-operator< 0.2.172-r2 | < 0.2.151-r4 | All versions (No fix recorded)
kubescape-operator-fips< 0.2.151-r6
kubescape-server< 4.0.10-r3
kubescape-server-downloader< 4.0.10-r3
kubescape-server-fips< 4.0.10-r4
kubescape-server-fips-downloader< 4.0.10-r4
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kyverno-1.14All versions (No fix recorded)
kyverno-1.15< 1.15.3-r24
kyverno-1.16< 1.16.4-r12
kyverno-1.17< 1.17.2-r35 | All versions (No fix recorded)
kyverno-1.18< 1.18.1-r11
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15< 1.15.3-r24
kyverno-background-controller-1.16< 1.16.4-r12
kyverno-background-controller-1.17< 1.17.2-r17
kyverno-background-controller-1.18< 1.18.1-r11
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15< 1.15.20-r9
kyverno-background-controller-fips-1.16< 1.16.4-r11
kyverno-background-controller-fips-1.17< 1.17.2-r12
kyverno-background-controller-fips-1.18< 1.18.2-r3
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15< 1.15.3-r24
kyverno-cleanup-controller-1.16< 1.16.4-r12
kyverno-cleanup-controller-1.17< 1.17.2-r17
kyverno-cleanup-controller-1.18< 1.18.1-r11
kyverno-cleanup-controller-fips-1.14All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.15< 1.15.20-r9
kyverno-cleanup-controller-fips-1.16< 1.16.4-r11
kyverno-cleanup-controller-fips-1.17< 1.17.2-r12
kyverno-cleanup-controller-fips-1.18< 1.18.2-r3
kyverno-cli-1.14All versions (No fix recorded)
kyverno-cli-1.15< 1.15.3-r24
kyverno-cli-1.17< 1.17.2-r17 | < 1.17.2-r35
kyverno-cli-1.18< 1.18.1-r11
kyverno-cli-fips-1.14All versions (No fix recorded)
kyverno-cli-fips-1.15< 1.15.20-r9
kyverno-cli-fips-1.16< 1.16.4-r11
kyverno-cli-fips-1.18< 1.18.2-r3
kyverno-fips-1.14All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 415

References

11 links

github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7X Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
github.com/oras-project/oras-go/pull/1152X Refsource MISCREPORTFIXWEBIssue TrackingPatch
github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991X Refsource MISCFIXWEBPatch
github.com/oras-project/oras-go/releases/tag/v2.6.1X Refsource MISCWEBRelease Notes
ubuntu.com/security/CVE-2026-50151REPORT
www.cve.org/CVERecord?id=CVE-2026-50151REPORT
security-tracker.debian.org/tracker/CVE-2026-50151Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50151.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-50151Advisory
github.com/oras-project/oras-goPACKAGE

Show all 11 references

www.suse.com/security/cve/CVE-2026-50151WEB