Read the docs
TI-2026-36926 Aliases CVE-2026-50162GHSA-8xwf-rjm4-xvhv

oras-go: file store write outside workingDir via symlink traversal

Priority HIGH 70CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 9 fixed, 15 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Partial oras-go (oras-project): 2.6.1oras.land/oras-go/v2 (Go): 2.6.1Red Hat: 12 advisoriesRed Hat: 9 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oras-projectoras-gobefore 2.6.12.6.1Patch availableCNA
—oras.land/oras-go/v2 (Go)before 2.6.12.6.1Patch availableGHSA-8xwf-rjm4-xvhv
  • oras-go Vendororas-project Affected before 2.6.1 Fixed in 2.6.1 Patch available CNA
  • oras.land/oras-go/v2 (Go) Vendor— Affected before 2.6.1 Fixed in 2.6.1 Patch available GHSA-8xwf-rjm4-xvhv

Remediation

  • Fix · CNA oras-go (oras-project) Fixed in 2.6.1
  • Fix · GHSA-8xwf-rjm4-xvhv oras.land/oras-go/v2 (Go) Fixed in 2.6.1 Advisory →

Red Hat 12 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83663 Released 2026-10-15 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9
  • RHSA-2026:83662 Released 2026-10-15 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.11 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9 +1
Show 9 more Red Hat advisories
  • RHSA-2026:77273 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.8 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:76752 Released 2026-10-06 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:42241 Released 2026-07-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images helm3-3.21.3-0.1.2.hum1@aarch64, helm3-3.21.3-0.1.2.hum1@src, helm3-3.21.3-0.1.2.hum1@x86_64
  • RHSA-2026:42230 Released 2026-07-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm4-4.2.3-0.1.2.hum1@aarch64, helm4-4.2.3-0.1.2.hum1@src, helm4-4.2.3-0.1.2.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
MCP Server for Red Hat OpenShiftAffectedNo fix planned: Will not fix
OpenShift LightspeedAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet: Fix deferred
Red Hat Openshift Data Foundation 4AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Migration Toolkit for Virtualization 2.10Fixed RHSA-2026:83663
Migration Toolkit for Virtualization 2.11Fixed RHSA-2026:83662
OpenShift Security Profiles Operator 1Fixed RHSA-2026:76752
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Hardened ImagesFixed RHSA-2026:42230, RHSA-2026:42241
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:77273
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Not affected: 23 products
  • Deployment Validation Operator
  • Gatekeeper 3
  • Migration Toolkit for Virtualization 2.10
  • Migration Toolkit for Virtualization 2.11
  • Multicluster Global Hub
  • OpenShift Developer Tools and Services
  • OpenShift Security Profiles Operator 1
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Edge Manager 1
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Hardened Images
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50162
  2. 2026-10-03 Alias added: GHSA-8xwf-rjm4-xvhv
  3. 2026-10-07 Fix available: RHSA-2026:77269 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:77273 · Red Hat
  5. 2026-10-07 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
  7. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83662 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:83663 · Red Hat
  10. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10, Migration Toolkit for Virtualization 2.11 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  12. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  13. 2026-10-27 Affected versions changed · Red Hat
  14. 2026-11-01 Affected versions changed · Red Hat

References

Other 4

  • TI-2026-58829 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) CVSS 3.1HIGH 8.8
  • TI-2026-36927 Path traversal in oras-project oras-go CVSS 3.1HIGH 7.1
  • TI-2026-58830 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing CVSS 3.1MEDIUM 4.7
  • TI-2026-40126 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVSS 3.1MEDIUM 6.5
  • TI-2026-36234 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences