Read the docs
TI-2026-36919 Aliases CVE-2026-50151GHSA-jxpm-75mh-9fp7

oras-go: credential forwarding via unvalidated Location header in blob upload

Priority HIGH 72CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial oras-go (oras-project): 2.6.1oras.land/oras-go/v2 (Go): 2.6.1Red Hat: 7 advisoriesRed Hat: 6 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oras-projectoras-gobefore 2.6.12.6.1Patch availableCNA
—oras.land/oras-go/v2 (Go)before 2.6.12.6.1Patch availableGHSA-jxpm-75mh-9fp7
  • oras-go Vendororas-project Affected before 2.6.1 Fixed in 2.6.1 Patch available CNA
  • oras.land/oras-go/v2 (Go) Vendor— Affected before 2.6.1 Fixed in 2.6.1 Patch available GHSA-jxpm-75mh-9fp7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:oras:*:*:*:*:*:go:*:*before 2.6.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:oras:*:*:*:*:*:go:*:* Versions before 2.6.1 Vulnerable ·backstage

Remediation

  • Fix · CNA oras-go (oras-project) Fixed in 2.6.1
  • Fix · GHSA-jxpm-75mh-9fp7 oras.land/oras-go/v2 (Go) Fixed in 2.6.1 Advisory →

Red Hat 7 advisories

  • RHSA-2026:73419 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.6.6 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:73038 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:71597 Released 2026-09-24 · Red Hat rating Important
    Multicluster Global Hub 1.5.8 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
Show 4 more Red Hat advisories
  • RHSA-2026:68515 Released 2026-09-17 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67842 Released 2026-09-16 · Red Hat rating Important
    Multicluster Global Hub 1.7.3 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67516 Released 2026-09-15 · Red Hat rating Important
    Multicluster Global Hub 1.4.9 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:47737 Released 2026-07-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Multicluster Global Hub 1.4.9Fixed RHSA-2026:67516
Multicluster Global Hub 1.5.8Fixed RHSA-2026:71597
Multicluster Global Hub 1.6.6Fixed RHSA-2026:73419
Multicluster Global Hub 1.7.4Fixed RHSA-2026:67842
Multicluster Global Hub 1.8.2Fixed RHSA-2026:68515, RHSA-2026:73038
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:47737
Not affected: 7 products
  • Gatekeeper 3
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Multicluster Global Hub 1.8.2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50151
  2. 2026-10-03 Alias added: GHSA-jxpm-75mh-9fp7
  3. 2026-11-03 Affected versions changed · Red Hat
  4. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Exploit 1

Patch 2

Other 2

  • TI-2026-58829 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) CVSS 3.1HIGH 8.8
  • TI-2026-36926 oras-go: file store write outside workingDir via symlink traversal CVSS 4.0MEDIUM 6.9
  • TI-2026-36927 Path traversal in oras-project oras-go CVSS 3.1HIGH 7.1
  • TI-2026-58830 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing CVSS 3.1MEDIUM 4.7
  • TI-2026-40126 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVSS 3.1MEDIUM 6.5
  • TI-2026-36234 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences