Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔵 oras-go Credential Leak via Unvalidated Location Header (#CVE-2026-50151) -DC-Jul2026-820 https://dailycve.com/oras-go-credential-leak-via-unvalidated-location-header-cve-2026-50151-dc-jul2026-820/
Post summary
The post announces a credential‑leak vulnerability (CVE-2026-50151) due to an unvalidated location header, providing only the disclosure link without PoC or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | oras | - | go | - |