There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from
    a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a
    malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/,
    http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http://
    token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(),
    fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1. (CVE-2026-48978)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21331-1 advisory.

    This update for helm fixes the following issue

    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).

    Changes for helm:

    - Update to version 3.21.2.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory.

    Update to version 3.21.1:

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276644).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-     range panic       (bsc#1272402).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278270).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278273).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278688).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22650-1 advisory.

    This update for helm fixes the following issue

    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).

    Changes for helm:

    - Update to version 3.21.2.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from     a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a     malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/,     http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http://     token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(),     fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1. (CVE-2026-48978)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2823-1 advisory.

    This update for helm fixes the following issues

    - Update to version 3.21.2
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation bypass and privilege escalation (bsc#1266598).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
444257	SCA: security update for oras.land/oras-go, oras.land/oras-go/v2 (GHSA-xf85-363p-868w)	Tenable Cloud Security	SCA Checks	7/2/2026	8/31/2026	low
444257	SCA: security update for oras.land/oras-go, oras.land/oras-go/v2 (GHSA-xf85-363p-868w)	Tenable Self-Hosted Container Security	SCA Checks	7/2/2026	8/31/2026	low
327242	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21331-1)	Nessus	SuSE Local Security Checks	7/16/2026	7/16/2026	low
344664	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)	Nessus	SuSE Local Security Checks	9/11/2026	9/11/2026	high
327567	SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:22650-1)	Nessus	SuSE Local Security Checks	7/17/2026	7/17/2026	low
327785	Linux Distros Unpatched Vulnerability : CVE-2026-48978	Nessus	Misc.	7/18/2026	8/1/2026	low
326332	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:2823-1)	Nessus	SuSE Local Security Checks	7/10/2026	7/10/2026	low

Detections

Analytics

Plugins Search

low

low

low

high

low

low

low