Vulnerability-Lookup

CVE-2026-85732 (GCVE-0-2026-85732)

Vulnerability from cvelistv5 – Published: 2026-09-16 16:22 – Updated: 2026-09-16 17:29

Title

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:29 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/commit/31…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
oras-project	oras-go	Affected: < 2.6.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:29:34.362450Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:29:51.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:22:14.881Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h7vf-4x9w-h99v",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85732",
    "datePublished": "2026-09-16T16:22:14.881Z",
    "dateReserved": "2026-09-04T14:50:16.718Z",
    "dateUpdated": "2026-09-16T17:29:51.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-85732",
      "date": "2026-09-22",
      "epss": "0.00379",
      "percentile": "0.31807"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "oras-go",
                "vendor": "oras-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.6.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."
          }
        ],
        "id": "CVE-2026-85732",
        "lastModified": "2026-09-16T18:17:18.070",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-85732",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:29:34.362450Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-16T17:18:16.000",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-09-16T19:08:39+00:00",
      "cve": "CVE-2026-85732",
      "id": "CVE-2026-85732",
      "initial_release_date": "2026-09-16T16:22:14.881000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/oras-project/oras-go: oras-go: Blind Server-Side Request Forgery via unvalidated Link header URL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85732.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:30:38Z",
      "cve": "CVE-2026-85732",
      "id": "CVE-2026-85732",
      "initial_release_date": "2026-09-18T00:24:45Z",
      "product_status:first_fixed": "24",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "80",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-85732",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-85732.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85732",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T17:29:34.362450Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T17:29:47.317Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "oras-go",
              "vendor": "oras-project",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.6.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-16T16:22:14.881Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
            },
            {
              "name": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
            },
            {
              "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
            }
          ],
          "source": {
            "advisory": "GHSA-h7vf-4x9w-h99v",
            "discovery": "UNKNOWN"
          },
          "title": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-85732",
        "datePublished": "2026-09-16T16:22:14.881Z",
        "dateReserved": "2026-09-04T14:50:16.718Z",
        "dateUpdated": "2026-09-16T17:29:51.661Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-85732

Vulnerability from fkie_nvd - Published: 2026-09-16 17:18 - Updated: 2026-09-16 18:17

Severity

4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842
	security-advisories@github.com	https://github.com/oras-project/oras-go/releases/tag/v2.6.2
	security-advisories@github.com	https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."
    }
  ],
  "id": "CVE-2026-85732",
  "lastModified": "2026-09-16T18:17:18.070",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85732",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T17:29:34.362450Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T17:18:16.000",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H7VF-4X9W-H99V

Vulnerability from github – Published: 2026-09-17 17:16 – Updated: 2026-09-17 17:16

Summary

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Details

Summary

oras-go's pagination helper parseLink() in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim's network.

This affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog).

Root Cause

parseLink() at registry/remote/utils.go:54 calls resp.Request.URL.Parse(link) which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where http.NewRequestWithContext() creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between parseLink output and the HTTP request.

Affected Code Paths

registry/remote/repository.go:Tags() calls parseLink() for next page URL
registry/remote/repository.go:Referrers() calls parseLink() for next page URL
registry/remote/registry.go:Repositories() calls parseLink() for next page URL

Impact

Blind SSRF from the victim's network. A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints:

Cloud instance metadata endpoints for service discovery and IAM role enumeration
Internal HTTP services for port scanning and triggering side effects
If the victim's credential store maps credentials for the SSRF target host, those credentials are attached to the request (auth.Client looks up creds by request host)

The attacker cannot read the response body (it's parsed as JSON and fails), making this a blind SSRF. However, timing and error differences can confirm internal service existence.

Attack Chain

Victim calls repo.Tags() / repo.Referrers() / registry.Repositories() against attacker-controlled registry
Registry returns a valid first page + malicious Link header pointing to an internal endpoint
parseLink() extracts the absolute URL with zero validation
Pagination loop makes GET request to the internal endpoint from victim's network

PoC

Expand PoC

// Malicious registry handler for /v2/repo/tags/list:
func handler(w http.ResponseWriter, r *http.Request) {
    // Link header points to cloud metadata or internal service
    w.Header().Set("Link", `<http://internal-service:8080/admin>; rel="next"`)
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string][]string{"tags": {"v1"}})
}

// Victim code:
repo, _ := remote.NewRepository("attacker-registry.io/repo")
repo.Tags(ctx, "", func(tags []string) error { return nil })
// Result: GET http://internal-service:8080/admin is made from victim's network

Suggested Fix

Validate that the URL returned by parseLink() has the same host and scheme as the original request before using it for the next pagination request. Reject cross-host or scheme-downgrade URLs.

Reported by zx (Jace)

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.6.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "oras.land/oras-go/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:16:02Z",
    "nvd_published_at": "2026-09-16T17:18:16Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\noras-go\u0027s pagination helper `parseLink()` in `registry/remote/utils.go` follows the `Link` response header from a registry without validating the URL\u0027s host or scheme. When a malicious registry returns a `Link` header containing an absolute URL pointing to an arbitrary host (e.g., a cloud metadata endpoint), the client makes GET requests to that host from the victim\u0027s network.\n\nThis affects all pagination-based listing operations: Tags, Referrers, and Repositories (catalog).\n\n## Root Cause\n\n`parseLink()` at `registry/remote/utils.go:54` calls `resp.Request.URL.Parse(link)` which, for absolute URLs, returns the absolute URL unchanged. The result is passed directly to the next pagination loop iteration where `http.NewRequestWithContext()` creates a GET request to the attacker-specified URL. No host comparison, scheme validation, or IP filtering exists between `parseLink` output and the HTTP request.\n\n## Affected Code Paths\n\n- `registry/remote/repository.go:Tags()` calls `parseLink()` for next page URL\n- `registry/remote/repository.go:Referrers()` calls `parseLink()` for next page URL\n- `registry/remote/registry.go:Repositories()` calls `parseLink()` for next page URL\n\n## Impact\n\n**Blind SSRF from the victim\u0027s network.** A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints:\n\n- Cloud instance metadata endpoints for service discovery and IAM role enumeration\n- Internal HTTP services for port scanning and triggering side effects\n- If the victim\u0027s credential store maps credentials for the SSRF target host, those credentials are attached to the request (auth.Client looks up creds by request host)\n\nThe attacker cannot read the response body (it\u0027s parsed as JSON and fails), making this a blind SSRF. However, timing and error differences can confirm internal service existence.\n\n## Attack Chain\n\n1. Victim calls `repo.Tags()` / `repo.Referrers()` / `registry.Repositories()` against attacker-controlled registry\n2. Registry returns a valid first page + malicious Link header pointing to an internal endpoint\n3. `parseLink()` extracts the absolute URL with zero validation\n4. Pagination loop makes GET request to the internal endpoint from victim\u0027s network\n\n## PoC\n\n\u003cdetails\u003e\n\u003csummary\u003eExpand PoC\u003c/summary\u003e\n\n```go\n// Malicious registry handler for /v2/repo/tags/list:\nfunc handler(w http.ResponseWriter, r *http.Request) {\n    // Link header points to cloud metadata or internal service\n    w.Header().Set(\"Link\", `\u003chttp://internal-service:8080/admin\u003e; rel=\"next\"`)\n    w.Header().Set(\"Content-Type\", \"application/json\")\n    json.NewEncoder(w).Encode(map[string][]string{\"tags\": {\"v1\"}})\n}\n\n// Victim code:\nrepo, _ := remote.NewRepository(\"attacker-registry.io/repo\")\nrepo.Tags(ctx, \"\", func(tags []string) error { return nil })\n// Result: GET http://internal-service:8080/admin is made from victim\u0027s network\n```\n\n\u003c/details\u003e\n\n## Suggested Fix\n\nValidate that the URL returned by `parseLink()` has the same host and scheme as the original request before using it for the next pagination request. Reject cross-host or scheme-downgrade URLs.\n\nReported by **zx (Jace)**",
  "id": "GHSA-h7vf-4x9w-h99v",
  "modified": "2026-09-17T17:16:02Z",
  "published": "2026-09-17T17:16:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85732"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oras-project/oras-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"
}

OPENSUSE-SU-2026:11832-1

Vulnerability from csaf_opensuse - Published: 2026-09-21 00:00 - Updated: 2026-09-22 09:43

Summary

helm3-3.22.0-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2026-85732.

CVE-2026-85732

4.7 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Recommended: 16 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-85732 (GCVE-0-2026-85732)

FKIE_CVE-2026-85732

GHSA-H7VF-4X9W-H99V

Summary

Root Cause

Affected Code Paths

Impact

Attack Chain

PoC

Suggested Fix

OPENSUSE-SU-2026:11832-1

Tags

Sightings

Nomenclature

Related by attack behaviour