Server-Side Request Forgery in ORAS-GO Library by OraS

CVE-2026-85732

What is CVE-2026-85732?

The ORAS-GO library, used for managing OCI artifacts, contains a vulnerability that allows for server-side request forgery (SSRF) due to improper validation of absolute URLs from registry-controlled Link response headers. The affected version, prior to 2.6.2, fails to validate the scheme, host, or port of these URLs, leading to potential exploitation when a victim performs pagination-based listing operations against a malicious registry. Although the attacker cannot directly receive the response body, they can infer the reachability of internal services based on timing and error responses. Additionally, credentials may be unintentionally leaked if the victim has a stored entry for the target host. Users are advised to upgrade to version 2.6.2 or above to mitigate this security risk.

References