CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
A malicious registry can hijack Bearer token realms to trigger SSRF and exfiltrate credentials from internal networks or downgrade connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48978?
CVE-2026-48978 is a low-severity server-side request forgery vulnerability in oras-project oras-go, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
Which versions are affected by CVE-2026-48978?
5 open source packages ship an affected version, including oras.land/oras-go/v2 and oras.land/oras-go.
| Package | Affected | Fixed in |
|---|---|---|
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
oras.land/oras-go Go | All versions to 1.2.7 | None |
oras.land/oras-go Go | All versions to 1.2.7 | None |
Linux distribution packages (6)
helm SUSE:Linux Enterprise Server 16.0 | All versions | 3.21.2-160000.2.2 |
helm SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.21.2-160000.2.2 |
helm SUSE:Linux Micro 6.2 | All versions | 3.21.2-160000.2.2 |
helm openSUSE:Leap 16.0 | All versions | 3.21.2-160000.2.1 |
helm openSUSE:Tumbleweed | All versions | 4.2.2-2.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.21.2-2.1 |
How do I fix CVE-2026-48978?
Upgrade oras.land/oras-go/v2 to 2.6.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-48978 being exploited?
There is no known exploitation of CVE-2026-48978 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GF32442, CLEANSTART-2026-WF30790, CLEANSTART-2026-ZA65601, DEBIAN-CVE-2026-48978, ECHO-9796-5913-82cc, GHSA-xf85-363p-868w and 200 more.