CVE-2026-85732 Overview
CVE-2026-85732 is a Server-Side Request Forgery (SSRF) vulnerability in oras-go, a Go library for managing Open Container Initiative (OCI) artifacts. Versions prior to 2.6.2 contain a flaw in the parseLink function inside registry/remote/utils.go. The function accepts an absolute URL supplied by a registry through the HTTP Link response header without validating its scheme, host, or port. Pagination operations for Tags, Referrers, and Repositories then issue GET requests to attacker-selected destinations from the victim's network. The maintainers consolidated remediation with the earlier advisory GHSA-3hr5-mjrr-hfjh and fixed the issue in version 2.6.2.
Critical Impact
A malicious registry can redirect victim clients toward internal services, enabling blind SSRF and potential credential leakage when the credential store contains an entry for the attacker-chosen host.
Affected Products
- oras-go versions prior to 2.6.2
- Applications embedding registry/remote/utils.go pagination logic
- Downstream tooling that performs Tags, Referrers, or Repositories listing against untrusted registries
Discovery Timeline
- 2026-09-16 - CVE-2026-85732 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-85732
Vulnerability Analysis
The vulnerability, categorized as [CWE-918] Server-Side Request Forgery, resides in the parseLink helper used by oras-go to process HTTP Link headers returned by an OCI registry. During pagination of Tags, Referrers, or Repositories endpoints, the client follows the next URL provided by the server. Because parseLink accepts an absolute URL without verifying that the scheme, host, or port match the originally contacted registry, an attacker who controls a malicious registry can point the follow-up request to an arbitrary destination reachable from the victim host.
The response body is not returned to the attacker, making this a blind SSRF. However, timing differences and error responses can reveal whether internal services are reachable. If the client's credential store contains an entry for the attacker-selected host, the library may attach those credentials to the outbound request, enabling credential exposure to internal endpoints.
Root Cause
The root cause is missing validation of the parsed URL returned from the Link header. The original implementation of parseLink in registry/remote/utils.go did not compare the parsed URL's scheme and authority against the request context. The fix in version 2.6.2 introduces net/url handling to constrain follow-up requests to the original registry origin.
Attack Vector
Exploitation requires a victim to perform a pagination-based listing operation against a registry controlled by the attacker. The registry responds with a Link header containing an absolute URL that targets an internal service, cloud metadata endpoint, or another host on the victim's network. User interaction, in the form of initiating the listing operation, is required.
// Patch excerpt: registry/remote/utils.go
"fmt"
"io"
"net/http"
+ "net/url"
"strings"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
// Source: https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842
The patch introduces the net/url package to enable proper parsing and validation of the follow-up URL against the original registry endpoint before issuing a pagination request.
Detection Methods for CVE-2026-85732
Indicators of Compromise
- Outbound HTTP requests from build agents or CI/CD workers targeting internal IP ranges shortly after contacting an external OCI registry
- Unexpected authentication headers sent to non-registry hosts by processes linked against oras-go
- Registry responses containing Link headers whose absolute URLs reference hosts different from the queried registry
Detection Strategies
- Inspect network telemetry for cross-boundary requests originating from container tooling that consumes oras-go
- Perform software composition analysis to enumerate binaries and services importing oras-go at versions below 2.6.2
- Add egress logging rules that flag pagination requests deviating from the initial registry host
Monitoring Recommendations
- Log the source and destination hosts of every registry pagination request generated by build and deployment pipelines
- Alert on credential store lookups that succeed for hosts not on an allowlist of trusted registries
- Correlate outbound HTTP timing anomalies from registry client processes with internal service access patterns
How to Mitigate CVE-2026-85732
Immediate Actions Required
- Upgrade oras-go to version 2.6.2 or later in all dependent projects and rebuild affected binaries
- Audit CI/CD systems, container registries, and artifact management tooling that embed oras-go
- Restrict egress from build and registry client hosts to known registry endpoints only
Patch Information
The consolidated fix is available in oras-gov2.6.2. The remediation commit is documented in the GitHub commit update and further described in the GitHub Security Advisory GHSA-h7vf-4x9w-h99v. Maintainers note this report duplicates GHSA-3hr5-mjrr-hfjh, where the consolidated remediation resides.
Workarounds
- Avoid performing Tags, Referrers, or Repositories pagination operations against untrusted or unauthenticated registries
- Configure network policies that block outbound requests from registry clients to internal address ranges and cloud metadata endpoints
- Scope credential store entries to specific registry hosts to limit credential exposure if pagination is redirected
# Update oras-go to the fixed release
go get github.com/oras-project/oras-go/v2@v2.6.2
go mod tidy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
