CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

• CWE-918

• https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842
• https://github.com/oras-project/oras-go/releases/tag/v2.6.2
• https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v
• https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85721The AsyncHttpClient (AHC) library allows Java applications t…7.5
• CVE-2026-85724Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…9.6
• CVE-2026-85725LightRAG provides simple and fast retrieval-augmented genera…5.9
• CVE-2026-8573Integer overflow in Codecs in Google Chrome on Windows prior…8.3
• CVE-2026-85730smol-toml is a small, fast, and correct TOML parser and seri…8.2
• CVE-2026-85731oras-go is a Go library for managing OCI artifacts. Prior to…8.8
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2