2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48978

CVE-2026-48978: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48978

CVE-2026-48978:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oras.land/oras-go/v2	go	< 2.6.1	2.6.1
oras.land/oras-go	go	<= 1.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the oras-go library's handling of the realm parameter from a WWW-Authenticate: Bearer challenge. A malicious registry could provide a crafted realm URL to trigger a Server-Side Request Forgery (SSRF) or a TLS downgrade. The root cause was a lack of validation in the registry/remote/auth.Client.Do function, which would pass the unvalidated realm URL to token-fetching functions.

The patch addresses this by introducing a validateRealm function that checks the realm URL's scheme and host. It ensures the scheme is http or https, prevents downgrading from https to http, and blocks IP addresses in private, loopback, or other reserved ranges. This validation is now called within Client.Do before the realm is used.

The identified vulnerable functions are Client.Do, which failed to validate the input, and the token fetching functions it calls (Client.fetchBearerToken, Client.fetchDistributionToken, Client.fetchOAuth2Token), which would execute the malicious request. An engineer seeing these functions in a runtime profile, particularly Client.Do followed by one of the fetch calls, should investigate for potential exploitation of this vulnerability.

Vulnerable functions

Client.Do

registry/remote/auth/client.go

This function handles the authentication challenge from a registry. Before the patch, it extracted the `realm` parameter from the `WWW-Authenticate` header and used it to fetch a token without any validation. This allowed a malicious registry to provide a URL to an internal service (SSRF) or a URL with a less secure protocol (`http` instead of `https`). The patch added a call to the new `validateRealm` function to sanitize the `realm` URL before it's used.

Client.fetchBearerToken

registry/remote/auth/client.go

This function is responsible for making the outbound HTTP request to the `realm` URL to fetch a bearer token. It receives the (previously unvalidated) `realm` URL from the `Client.Do` function. During an exploit, this function would be the one to actually make the malicious request to an internal or downgraded URL, making it a key part of the vulnerable execution flow.

Client.fetchDistributionToken

registry/remote/auth/client.go

Similar to `fetchBearerToken`, this function is implicated in the vulnerability as it is likely also involved in fetching tokens using the unvalidated `realm` URL. The advisory groups these functions together, suggesting they follow the same vulnerable pattern of making requests to a user-controllable and unvalidated URL.

Client.fetchOAuth2Token

registry/remote/auth/client.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.