CVE-2026-50151: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location h
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-50151
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-501510.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-50151 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for oras-go is a
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-50163: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/…nvd · 2026-07-17
- unknownCVE-2026-50162: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in cont…nvd · 2026-07-17
- unknownCVE-2026-48978: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the re…nvd · 2026-07-17
- highGHSA-fxhp-mv3v-67qp: `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via p…ghsa · 2026-07-01
More from NVD Recent CVEs
- unknownCVE-2026-70474: Flowise is a drag-and-drop user interface for building customized large language model (LLM) f…2026-08-04
- unknownCVE-2026-70473: Flowise is a drag-and-drop user interface for building customized large language model (LLM) f…2026-08-04
- unknownCVE-2026-70472: Flowise is a drag & drop user interface to build a customized large language model flow. Prior…2026-08-04
- unknownCVE-2026-70471: Flowise is a drag-and-drop user interface for building customized large language model (LLM) f…2026-08-04
- mediumCVE-2026-69704: Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate databas…2026-08-04