{"id":"CVE-2026-50151","revision":"23add5f3f2b642c394c68090db9dc1f9","records":[{"revision":"23add5f3f2b642c394c68090db9dc1f9","observedAt":"2026-10-25T12:17:38.331+00:00","statement":{"source":"nvd","id":"CVE-2026-50151","aliases":[],"title":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authoriza…","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.","state":0,"publishedAt":"2026-07-17T20:17:23.683+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991","https://github.com/oras-project/oras-go/pull/1152","https://github.com/oras-project/oras-go/releases/tag/v2.6.1","https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50151","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-918"],"productCriteria":["cpe:2.3:a:linuxfoundation:oras:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-07-17T20:17:23.683","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-50151","identifiers":["CVE-2026-50151"]},"retained":false,"historicalAffected":[]}],"coverage":[]}