CVE-2026-48978 Overview
CVE-2026-48978 is a Server-Side Request Forgery (SSRF) vulnerability in oras-go, a Go library for managing Open Container Initiative (OCI) artifacts. The auth.Client implementation follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host. A malicious or compromised registry can redirect authentication requests to internal endpoints such as http://169.254.169.254/, http://10.0.0.x/, or http://127.0.0.1/. The flaw also permits downgrading an https:// registry connection to an http:// token endpoint. The issue is fixed in version 2.6.1.
Critical Impact
Attackers controlling a registry response can coerce clients into contacting internal-only services, including cloud metadata endpoints, and can strip transport encryption from token exchanges.
Affected Products
- oras-go versions prior to 2.6.1
- Applications importing registry/remote/auth from oras-go
- Tooling that authenticates to OCI registries using auth.Client
Discovery Timeline
- 2026-07-17 - CVE-2026-48978 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-48978
Vulnerability Analysis
The vulnerability resides in registry/remote/auth/client.go. When a registry responds with a 401 Unauthorized and a WWW-Authenticate: Bearer challenge, auth.Client parses the realm parameter and issues a token request to that URL. The client trusts the realm value without checking whether the scheme matches the original request or whether the host resolves to an internal address. This behavior is exercised in Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. The weakness is categorized under [CWE-319] Cleartext Transmission of Sensitive Information because bearer credentials may be transmitted over unencrypted HTTP after a downgrade.
Root Cause
The root cause is missing validation of the realm URL returned in the bearer challenge. The library accepts any absolute URL and dispatches the token request through the standard HTTP client. No allowlist of hosts, no scheme enforcement, and no restriction on link-local or loopback destinations is applied before the request is sent.
Attack Vector
An attacker operating a malicious registry, or one who has compromised a legitimate registry, returns a crafted WWW-Authenticate header. The realm points to an internal target such as an AWS Instance Metadata Service (IMDS) endpoint, a Kubernetes control-plane API, or an internal admin service. When the oras-go client authenticates, it issues an outbound HTTP request from within the trusted network boundary. If the realm uses http://, credentials or tokens supplied by the client are exposed in cleartext.
// Fix introduced in registry/remote/auth/client.go (v2.6.1)
"errors"
"fmt"
"io"
+ "net"
"net/http"
"net/url"
"strings"
// Source: https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764
The patch adds the net package to enable host and address parsing, supporting the new validation logic that rejects unsafe realm targets before dispatching the token request.
Detection Methods for CVE-2026-48978
Indicators of Compromise
- Outbound HTTP requests from build agents or CI runners to 169.254.169.254, 127.0.0.1, or RFC1918 ranges immediately following registry pulls.
- Registry authentication traffic where the token endpoint uses http:// while the registry endpoint uses https://.
- WWW-Authenticate: Bearer responses containing a realm whose host differs from the registry host.
Detection Strategies
- Inspect proxy and egress logs for token requests originating from OCI clients targeting link-local, loopback, or internal RFC1918 addresses.
- Correlate registry pull events with subsequent unexpected metadata service access from the same process or container.
- Perform Software Composition Analysis (SCA) to inventory applications importing oras-go at versions below 2.6.1.
Monitoring Recommendations
- Enable IMDSv2 on AWS workloads and alert on any IMDSv1 access attempts from container hosts.
- Route all registry client traffic through an egress proxy that enforces destination allowlists.
- Log User-Agent strings from Go-based registry clients to identify vulnerable oras-go versions in transit.
How to Mitigate CVE-2026-48978
Immediate Actions Required
- Upgrade oras-go to version 2.6.1 or later in all Go modules and rebuild dependent binaries.
- Audit dependency graphs with go list -m all to locate transitive imports of oras-go.
- Rotate any registry credentials that may have been transmitted to attacker-controlled realm endpoints.
Patch Information
The fix is available in GitHub Release v2.6.1. Full technical background is provided in GitHub Security Advisory GHSA-xf85-363p-868w. The remediation is committed in the GitHub Commit Update.
Workarounds
- Restrict outbound network access from workloads running vulnerable oras-go builds to a curated registry allowlist.
- Block egress to 169.254.169.254 from containers that do not require cloud metadata access.
- Configure only trusted registries in client configuration to reduce exposure to malicious WWW-Authenticate responses.
# Update oras-go to the patched release
go get github.com/oras-project/oras-go/v2@v2.6.1
go mod tidy
go build ./...
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
