Executive brief
ORAS Go forwards registry credentials across registry redirects
Affected products
- Go oras.land/oras-go/v2
Junglewise Threat Intelligence
ORAS Go forwards registry credentials across registry redirects
Severity: medium · CVSS 4 · Published 2026-07-01
Technologies: oras.land/oras-go/v2 (Go). Vendors: Go.
Related threats
- oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute U
- oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.con
- GO-2026-5884 - ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go
- oras-project oras-go path traversal via hardlink resolution
- oras-project oras-go path traversal via symlink in resolveWritePath