# CVE-2026-48978: oras-project oras-go SSRF and TLS downgrade in auth.Client

Source: https://junglewise.ai/threats/cve-2026-48978-oras-project-oras-go-ssrf-and-tls-downgrade-in-auth-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-48978 · Severity: medium · CVSS 4 · Published 2026-07-17

oras-go is a Go library used to manage OCI artifacts, such as container images. A vulnerability in how the library handles authentication challenges allows a malicious or compromised registry to redirect the client to internal network addresses or downgrade secure connections to unencrypted HTTP. This could lead to the exposure of sensitive internal network information or the interception of login credentials by attackers.

Technologies: [oras.land/oras-go/v2 (Go)](https://junglewise.ai/threats/technologies/oras-land-oras-go-v2), [ORAS Project Oras-Go](https://junglewise.ai/threats/technologies/oras-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ORAS Project](https://junglewise.ai/threats/vendors/oras-project).

## Quick answers

**Is CVE-2026-48978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48978 being exploited in the wild.

**How severe is CVE-2026-48978?** Medium severity, with a CVSS score of 4, published 17 July 2026.

**Which products and versions are affected?** oras.land/oras-go (Go) <= 1.2.7, SEMVER:introduced=0,last_affected=1.2.7; oras.land/oras-go/v2 (Go) < 2.6.1, SEMVER:introduced=0,fixed=2.6.1; ORAS Project Oras-Go < 2.6.1, <= v2.6.0.

**Is there a fix for CVE-2026-48978?** Yes. oras.land/oras-go/v2 (Go): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48978 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48978?** Check whether you run oras.land/oras-go (Go), oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oras.land/oras-go/v2 (Go): upgrade to 2.6.1 or later

  ```sh
  go get oras.land/oras-go/v2@v2.6.1
  ```


## Technical details

The `auth.Client` in `oras-go` (prior to version 2.6.1) processes the `realm` URL from a registry's `WWW-Authenticate: Bearer` challenge without validating the scheme or host. A malicious registry can provide a `realm` pointing to internal IP ranges (e.g., 169.254.169.254, 127.0.0.1) to perform SSRF, or specify an `http://` URL when the registry was originally contacted via `https://`, causing a TLS downgrade. While cross-host realms on public DNS are permitted by the OCI spec, the lack of validation for sensitive IP literals and protocol downgrades allows for credential exfiltration and internal network probing. The fix in 2.6.1 introduces validation to reject unsafe schemes, protocol downgrades, and private/loopback IP literals.

## Affected products

- oras-project oras-go < 2.6.1

## Identifiers

- CVE-2026-48978
- GHSA-xf85-363p-868w
- GO-2026-5885

## Timeline

- 2026-06-08: patched: Version 2.6.1 released
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764](https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764)
- [https://github.com/oras-project/oras-go/releases/tag/v2.6.1](https://github.com/oras-project/oras-go/releases/tag/v2.6.1)
- [https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w](https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w)

## Related threats

- [ORAS-Go blind SSRF via unvalidated Link header in pagination](https://junglewise.ai/threats/cve-2026-85732-oras-go-blind-ssrf-via-unvalidated-link-header-in-pagination)
- [oras-go arbitrary file write via symlink-chain bypass in tar extraction](https://junglewise.ai/threats/cve-2026-85731-oras-go-arbitrary-file-write-via-symlink-chain-bypass-in-tar)
- [GO-2026-5884 - ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go](https://junglewise.ai/threats/go-2026-5884-oras-go-forwards-registry-credentials-across-registry-0c83b8d7)
- [oras-project oras-go path traversal via hardlink resolution](https://junglewise.ai/threats/cve-2026-50163-oras-project-oras-go-path-traversal-via-hardlink-resolution)
- [oras-project oras-go path traversal via symlink in resolveWritePath](https://junglewise.ai/threats/cve-2026-50162-oras-project-oras-go-path-traversal-via-symlink-in)