Executive brief
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go
Affected products
- Go oras.land/oras-go/v2
Junglewise Threat Intelligence
GO-2026-5884 - ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go
Severity: info ยท Published 2026-07-24
Technologies: oras.land/oras-go/v2 (Go). Vendors: Go.
Related threats
- oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute U
- oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.con
- oras-project oras-go path traversal via hardlink resolution
- oras-project oras-go path traversal via symlink in resolveWritePath
- oras-project oras-go Credential Leak via Unvalidated Location Header