CVE-2026-50151 oras-go: credential forwarding via unvalidated Location header in blob upload
A malicious registry can steal user credentials by returning a cross-host Location header during blob uploads in the oras-go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50151?
CVE-2026-50151 is a high-severity server-side request forgery vulnerability in oras-project oras-go, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-50151?
3 open source packages ship an affected version, including oras.land/oras-go/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
oras.land/oras-go/v2 Go | All versions | 2.6.1 |
Linux distribution packages (2)
helm openSUSE:Tumbleweed | All versions | 4.2.3-2.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.21.3-2.1 |
Products include Linuxfoundation Oras.
How do I fix CVE-2026-50151?
Upgrade oras.land/oras-go/v2 to 2.6.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-50151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50151 exists.
Sources
Also known as CLEANSTART-2026-BG37104, CLEANSTART-2026-CZ25792, CLEANSTART-2026-GY88228, DEBIAN-CVE-2026-50151, GHSA-jxpm-75mh-9fp7, GO-2026-5882 and 210 more.