Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.4, published 1 July 2026.

Which products and versions are affected?

oras.land/oras-go/v2 (Go) < 2.6.1; ORAS Project Oras-Go < 2.6.1.

Is there a fix for This vulnerability?

A patch was published on 2026-07-01: Advisory updated with patch information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

ORAS Project ORAS Go credential leakage in registry redirects

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-01: Advisory updated with patch information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.4 · Published 2026-07-01

ORAS Go, a library used for interacting with container registries, contains a vulnerability where it may inadvertently send sensitive login credentials to unintended servers. This occurs when a registry redirects a request to a different web address, causing the client to include the original authentication details in the new request. An attacker could potentially capture these credentials by tricking a user or automated system into connecting to a malicious registry that issues such redirects.

Technologies: oras.land/oras-go/v2 (Go), ORAS Project Oras-Go. Vendors: Go, ORAS Project.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.4, published 1 July 2026.
Which products and versions are affected?: oras.land/oras-go/v2 (Go) < 2.6.1; ORAS Project Oras-Go < 2.6.1.
Is there a fix for This vulnerability?: A patch was published on 2026-07-01: Advisory updated with patch information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run oras.land/oras-go/v2 (Go) or ORAS Project Oras-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ORAS Go is vulnerable to credential leakage across registry-origin boundaries. The issue manifests in two paths: first, when a manifest or metadata request is redirected to a different host or port, the original 'Authorization' header is retained; second, during blob uploads, the follow-up 'PUT' request to a new 'Location' target may carry the origin's credentials. This occurs because the HTTP client does not sufficiently validate if the redirect target matches the original origin before forwarding sensitive headers. The vulnerability affects both the ORAS Go library and the ORAS CLI when using registry configurations. A fix is available in version 2.6.1 which ensures credentials are removed when a redirect changes the HTTP origin.

Affected products

ORAS Project oras-go < 2.6.1

Timeline

2026-06-11: advisory: Initial advisory published
2026-07-01: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.