Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-01T21:35:45 oras-go: oras-go: Information disclosure and TLS downgrade via malicious registry realm 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CWE-918

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to perform Server-Side Request Forgery (SSRF) against internal networks, potentially disclosing sensitive information. Additionally, the flaw could lead to a Transport Layer Security (TLS) downgrade, causing user credentials to be sent over plaintext.

A flaw was found in oras-go. The auth.Client follows the realm URL from a registry's Bearer challenge without validating scheme or host, enabling SSRF to internal networks and TLS downgrade attacks. Upgrade to oras-go v2.6.1 or later. Gatekeeper 3 Fix deferred gatekeeper/gatekeeper-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/istio-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/metallb-rhel8-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/metallb-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-ansible-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-azure-cluster-api-controllers-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-helm-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-rukpak-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-rukpak-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-sdk-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ztp-site-generate-rhel8 Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/openstack-operator-bundle Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/rabbitmq-cluster-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-48978 https://nvd.nist.gov/vuln/detail/CVE-2026-48978 https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w