oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from     a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a     malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/,     http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http://     token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(),     fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1. (CVE-2026-48978)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22650-1 advisory.

    This update for helm fixes the following issue

    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).

    Changes for helm:

    - Update to version 3.21.2.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21331-1 advisory.

    This update for helm fixes the following issue

    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).

    Changes for helm:

    - Update to version 3.21.2.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2823-1 advisory.

    This update for helm fixes the following issues

    - Update to version 3.21.2
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation bypass and privilege escalation (bsc#1266598).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from
    a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a
    malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/,
    http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http://
    token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(),
    fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1. (CVE-2026-48978)

ID	Name	Product	Family	Severity
327785	Linux Distros Unpatched Vulnerability : CVE-2026-48978	Nessus	Misc.	low
327567	SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:22650-1)	Nessus	SuSE Local Security Checks	low
327242	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21331-1)	Nessus	SuSE Local Security Checks	low
326332	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:2823-1)	Nessus	SuSE Local Security Checks	low
444257	SCA: security update for oras.land/oras-go/v2 (GHSA-xf85-363p-868w)	Tenable Cloud Security	SCA Checks	low
444257	SCA: security update for oras.land/oras-go/v2 (GHSA-xf85-363p-868w)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-48978

low

Tenable Plugins

low

low

low

low

low

low