oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23984-1 advisory.

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265758).
    - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted     plugin       (bsc#1261939).
    - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to     insufficient plugin       provenance verification (bsc#1261935).
    - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted     Chart       (bsc#1261938).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
    - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the     storage.delete.enabled       configuration (bsc#1265428).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1276327).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1271997).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1281426).
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).
    - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows     internal network       probing (bsc#1281112).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21983-1 advisory.

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265758).
    - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted     plugin       (bsc#1261939).
    - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to     insufficient plugin       provenance verification (bsc#1261935).
    - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted     Chart       (bsc#1261938).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
    - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the     storage.delete.enabled       configuration (bsc#1265428).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1276327).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1271997).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1281426).
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).
    - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows     internal network       probing (bsc#1281112).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory.

    - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that     outlive expired CA       certificates (bsc#1258543).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1278702).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278624).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279390).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279395).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1279392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in
    content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the
    unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to
    resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such
    as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack:
    "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and
    ~/.ssh/config. This issue is fixed in version 2.6.2. (CVE-2026-50163)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in     content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the     unresolved target, causing os.Link(victim.secret, <extract_base>/payload.tar.gz/evil_cwd_link) to     resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such     as Name=payload.tar.gz/evil_cwd_link and Linkname=victim.secret with io.deis.oras.content.unpack:
    true, which can expose or tamper with files such as .env, .git/config, .aws/credentials, and     ~/.ssh/config. This issue is fixed in version 2.6.2. (CVE-2026-50163)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363069	SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:23984-1)	Nessus	SuSE Local Security Checks	Local	high
362531	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21983-1)	Nessus	SuSE Local Security Checks	Local	high
344683	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)	Nessus	SuSE Local Security Checks	Local	high
445682	SCA: security update for oras.land/oras-go/v2 (GHSA-fxhp-mv3v-67qp)	Tenable Cloud Security	SCA Checks	Local	high
445682	SCA: security update for oras.land/oras-go/v2 (GHSA-fxhp-mv3v-67qp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
327772	Linux Distros Unpatched Vulnerability : CVE-2026-50163	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50163

high

Tenable Plugins

high

high

high

high

high

high