CVE-2026-50151

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

• CWE-918

• https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991Patch
• https://github.com/oras-project/oras-go/pull/1152Issue Tracking, Patch
• https://github.com/oras-project/oras-go/releases/tag/v2.6.1Release Notes
• https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory
• https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7Exploit, Mitigation, Vendor Advisory

Published

Jul 17, 2026

Last Modified

Aug 26, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50144ncnn is a high-performance neural network inference framewor…7.1
• CVE-2026-50146Astro is a web framework. Prior to 6.3.3, when a component u…6.1
• CVE-2026-50147Metabase is an open-source business intelligence and embedde…7.6
• CVE-2026-50148Metabase is an open-source business intelligence and embedde…9.1
• CVE-2026-50149Contour is a Kubernetes ingress controller using Envoy proxy…6.5
• CVE-2026-5015A vulnerability was determined in elecV2 elecV2P up to 3.8.3…4.3
• CVE-2026-50152Ceph is an open-source distributed storage platform providin…9.1
• CVE-2026-50157Auth0 Symfony is a Symfony SDK for Auth0 Authentication and …6.5
• CVE-2026-50158yutu is an AI-powered toolkit for managing and growing YouTu…7.7
• CVE-2026-50159Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-5016A vulnerability was identified in elecV2 elecV2P up to 3.8.3…7.3
• CVE-2026-50160Hoppscotch is an API development ecosystem. In self-hosted d…10