Executive brief
oras-go is a Go library used to manage OCI artifacts, such as container images. A vulnerability in how the library handles authentication challenges allows a malicious or compromised registry to redirect the client to internal network addresses or downgrade secure connections to unencrypted HTTP. This could lead to the exposure of sensitive internal network information or the interception of login credentials by attackers.
Technical details
The `auth.Client` in `oras-go` (prior to version 2.6.1) processes the `realm` URL from a registry's `WWW-Authenticate: Bearer` challenge without validating the scheme or host. A malicious registry can provide a `realm` pointing to internal IP ranges (e.g., 169.254.169.254, 127.0.0.1) to perform SSRF, or specify an `http://` URL when the registry was originally contacted via `https://`, causing a TLS downgrade. While cross-host realms on public DNS are permitted by the OCI spec, the lack of validation for sensitive IP literals and protocol downgrades allows for credential exfiltration and internal network probing. The fix in 2.6.1 introduces validation to reject unsafe schemes, protocol downgrades, and private/loopback IP literals.
Affected products
- oras-project oras-go < 2.6.1
Timeline
- 2026-06-08: patched: Version 2.6.1 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD