CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

EUVD-2026-45297

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

CVE-2026-50163

The CVE concerns the oras-go library (OCI artifacts) prior to version 2.6.2, where ensureLinkPath in content/file/utils.go can return an unresolved hardlink target. During tar extraction, a hardlink entry with a relative Linkname could be resolved against the process CWD, allowing a path like pay...

CVE-2026-50163 oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

CVE-2026-48978

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

CVE-2026-48978

The CVE-2026-48978 issue affects the oras-go library prior to 2.6.1, where auth.Client can follow the registry’s Bearer challenge realm without validating the scheme/host. This enables a malicious or compromised registry to trigger SSRF to internal networks (e.g., 169.254.169.254, 10.0.0.x, 127.0...

OPENSUSE-SU-2026:11297-1 oras-1.3.3-2.1 on GA media

These are all security issues fixed in the oras-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-50151

A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller's credential...

CVE-2026-50163

A flaw was found in oras-go, a Go library used for managing OCI Open Container Initiative artifacts. An attacker can exploit this vulnerability by providing a specially crafted tarball containing a malicious hardlink. When this tarball is extracted, the hardlink can be manipulated to point to fil...

CVE-2026-48978

A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to...

CVE-2026-50162

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

CVE-2026-50163 vulnerabilities

Vulnerabilities for packages: linkerd2, trivy-fips, kube-mgmt, oras, rancher-agent, kubescape-server-fips, rancher-fleet, chartmuseum, flux-helm-controller-fips, crossplane-fips, headlamp-fips, helm-operator, helmfile, rancher-fleet-fips, helm, trivy-operator, argocd-image-updater-fips,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: linkerd2, trivy-fips, kube-mgmt, oras, rancher-agent, kubescape-server-fips, rancher-fleet, chartmuseum, flux-helm-controller-fips, crossplane-fips, headlamp-fips, helm-operator, helmfile, rancher-fleet-fips, helm, trivy-operator, argocd-image-updater-fips,...

CVE-2026-50163 vulnerabilities

Vulnerabilities for packages: gogatekeeper, gatekeeper, opa-envoy, helm, oras, ratify, chartmuseum, helm-operator, consul-k8s, zarf, conftest, k8ssandra-client, cilium-cli, grafana-operator, linkerd2, trivy, zot, trivy-operator, tigera-operator, argocd-image-updater, opa, steampipe, argo-cd,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: gogatekeeper, gatekeeper, opa-envoy, helm, oras, ratify, chartmuseum, helm-operator, consul-k8s, zarf, conftest, k8ssandra-client, cilium-cli, grafana-operator, linkerd2, trivy, zot, trivy-operator, tigera-operator, argocd-image-updater, opa, steampipe, argo-cd,...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21262-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21262-1 advisory. Changes in hauler: - update to 2.0.1 bsc1269433, CVE-2026-48702: bump go to 1.26.4 to squash CVE noise Full v2 Release notes:...

OPENSUSE-SU-2026:21262-1 Security update for hauler

This update for hauler fixes the following issues: Changes in hauler: - update to 2.0.1 bsc1269433, CVE-2026-48702: bump go to 1.26.4 to squash CVE noise Full v2 Release notes: https://github.com/hauler- dev/hauler/releases/tag/v2.0.0 - update to 2.0.0: v2.0.0 is a major release. It replaces...