# oras.land/oras-go/v2 (Go) vulnerabilities

6 known vulnerabilities (3 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v2.7.0 (Oct 23, 2026): no advisory affects it
- Newest unaffected release: v2.7.0 (Oct 23, 2026), the latest release
- Releases: 23 since v2.0.0 (Jan 18, 2023)
- Registry: https://pkg.go.dev/oras.land/oras-go/v2
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-85731: v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
- CVE-2026-85732: v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
- CVE-2026-50151: v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)
- CVE-2026-50162: v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)
- CVE-2026-50163: v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
- CVE-2026-48978: v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)

## Advisories (6)

### [CVE-2026-85731](https://cve.now/CVE-2026-85731): oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

- Severity: High 8.8
- Published: Sep 16, 2026
- Affected: fixed in 2.6.2.
- Fixed in v2.6.2 (released Jul 10, 2026, 68 days before disclosure).
- The latest release, v2.7.0, is not affected.

### [CVE-2026-85732](https://cve.now/CVE-2026-85732): oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

- Severity: Medium 4.7
- Published: Sep 16, 2026
- Affected: fixed in 2.6.2.
- Fixed in v2.6.2 (released Jul 10, 2026, 68 days before disclosure).
- The latest release, v2.7.0, is not affected.

### [CVE-2026-50151](https://cve.now/CVE-2026-50151): oras-go: credential forwarding via unvalidated Location header in blob upload

- Severity: High 7.5
- Published: Jul 17, 2026
- Affected: fixed in 2.6.1.
- Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
- The latest release, v2.7.0, is not affected.

### [CVE-2026-50162](https://cve.now/CVE-2026-50162): oras-go: file store write outside workingDir via symlink traversal

- Severity: Medium 6.9
- Published: Jul 17, 2026
- Affected: fixed in 2.6.1.
- Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
- The latest release, v2.7.0, is not affected.

### [CVE-2026-50163](https://cve.now/CVE-2026-50163): oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in \`oras-go\` tar extraction

- Severity: High 7.1
- Published: Jul 17, 2026
- Affected: fixed in 2.6.2.
- Fixed in v2.6.2 (released Jul 10, 2026, 7 days before disclosure).
- The latest release, v2.7.0, is not affected.

### [CVE-2026-48978](https://cve.now/CVE-2026-48978): oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

- Severity: Low 2.1
- Published: Jul 17, 2026
- Affected: fixed in 2.6.1.
- Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
- The latest release, v2.7.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/oras.land/oras-go/v2
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.