Detections
Analytics
SCA: security update for oras.land/oras-go, oras.land/oras-go/v2 (GHSA-xf85-363p-868w)
low Tenable Self-Hosted Container Security Plugin ID 444257
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from
a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a
malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/,
http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http://
token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(),
fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1. (CVE-2026-48978)
Solution
Update the oras.land/oras-go/v2 library and its related packages to version 2.6.1 or later.See Also
Plugin Details
Severity: Low
ID: 444257
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 7/2/2026
Updated: 8/31/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-48978
CVSS v3
Risk Factor: Low
Base Score: 3.1
Temporal Score: 2.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2.1
Threat Score: 0.5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/1/2026
Vulnerability Publication Date: 7/1/2026
Reference Information
CVE: CVE-2026-48978