Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-01T21:35:45 oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-522

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller's credentials, leading to information disclosure. Additionally, it can enable client-side Server-Side Request Forgery (SSRF) to a cross-host target.

A flaw was found in oras-go. During monolithic blob upload, the Authorization header is reused for cross-host Location redirects, allowing a malicious registry to exfiltrate caller credentials. Upgrade to oras-go v2.6.1 or later. Gatekeeper 3 Under investigation gatekeeper/gatekeeper-rhel9 Multicluster Global Hub Under investigation multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Service Mesh 3 Under investigation openshift-service-mesh/istio-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/multicloud-integrations-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/multicluster-operators-channel-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/multicluster-operators-subscription-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/metallb-rhel8-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/metallb-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-ansible-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-azure-cluster-api-controllers-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-helm-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-olm-rukpak-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-olm-rukpak-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-sdk-rhel8 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Under investigation openshift4/ztp-site-generate-rhel8 Red Hat OpenStack Platform 16.2 Under investigation rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Under investigation rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Under investigation rhoso-operators/openstack-operator-bundle Red Hat OpenStack Platform 18.0 Under investigation rhoso-operators/rabbitmq-cluster-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-50151 https://nvd.nist.gov/vuln/detail/CVE-2026-50151 https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7