ORAS Project ORAS Go credential leakage in registry redirects

Executive brief

ORAS Go, a library used for interacting with container registries, contains a vulnerability where it may inadvertently send sensitive login credentials to unintended servers. This occurs when a registry redirects a request to a different web address, causing the client to include the original authentication details in the new request. An attacker could potentially capture these credentials by tricking a user or automated system into connecting to a malicious registry that issues such redirects.

Technical details

ORAS Go is vulnerable to credential leakage across registry-origin boundaries. The issue manifests in two paths: first, when a manifest or metadata request is redirected to a different host or port, the original 'Authorization' header is retained; second, during blob uploads, the follow-up 'PUT' request to a new 'Location' target may carry the origin's credentials. This occurs because the HTTP client does not sufficiently validate if the redirect target matches the original origin before forwarding sensitive headers. The vulnerability affects both the ORAS Go library and the ORAS CLI when using registry configurations. A fix is available in version 2.6.1 which ensures credentials are removed when a redirect changes the HTTP origin.

Affected products

• ORAS Project oras-go < 2.6.1

Timeline

• 2026-06-11: advisory: Initial advisory published
• 2026-07-01: patched: Advisory updated with patch information

References

• https://api.github.com/users/mosskappa
• https://github.com/mosskappa
• https://api.github.com/users/mosskappa/gists%7B/gist_id%7D
• https://api.github.com/users/mosskappa/repos
• https://avatars.githubusercontent.com/u/205706019?v=4
• https://api.github.com/users/mosskappa/events%7B/privacy%7D