oras‑go is a Go library that handles OCI artifact storage. In versions before 2.6.1, the blob upload workflow incorrectly follows a Location header returned from a registry during a monolithic upload and re‑uses the initial Authorization header for the subsequent PUT to the redirect host. This behaviour allows a malicious registry to send a cross‑host Location to an attacker‑controlled endpoint and capture the caller’s credentials. The flaw leads to credential forwarding without validation, exposing the user’s authentication token and allowing potential abuse of internal services. It satisfies CWE‑522 (Inadequate Protection of Stored Credentials) and CWE‑918 (Server–Side Request Forgery).

The issue impacts the oras‑go library provided by the oras‑project. Releases prior to v2.6.1 implement the monolithic blob upload flow that is vulnerable; all versions that perform the same sequence are affected, while v2.6.1 and later contain the fix. The client follows the registry‑controlled Location header and re‑uses the Authorization header from the initial POST request when it performs the subsequent PUT request to the location provided by the registry. This allows a malicious registry to return a cross‑host Location and receive the caller’s credentials at an attacker‑controlled endpoint. The behavior satisfies both CWE‑522 (Inadequate Protection of Stored Credentials) and CWE‑918 (Server‑Side Request Forgery), enabling credential forwarding and potential SSRF against internal resources.

The CVSS base score is 7.5, indicating a high severity vulnerability with confidentiality compromise. The EPSS score is below 1 %, suggesting that exploitation probability is low but not negligible. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control a registry endpoint that issues a cross‑host Location header during a blob upload, and the client must automatically follow that redirect. Where clients trust arbitrary registries and do not validate redirect origins, the attack is viable.