CVE-2026-85732

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

// Malicious registry handler for /v2/repo/tags/list:
func handler(w http.ResponseWriter, r *http.Request) {
    // Link header points to cloud metadata or internal service
    w.Header().Set("Link", `<http://internal-service:8080/admin>; rel="next"`)
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string][]string{"tags": {"v1"}})
}

// Victim code:
repo, _ := remote.NewRepository("attacker-registry.io/repo")
repo.Tags(ctx, "", func(tags []string) error { return nil })
// Result: GET http://internal-service:8080/admin is made from victim's network

Blind SSRF from the victim's network. A malicious registry operator can force any oras-go client that lists tags, referrers, or repositories to issue GET requests to arbitrary internal endpoints:

• Cloud instance metadata endpoints for service discovery and IAM role enumeration
• Internal HTTP services for port scanning and triggering side effects
• If the victim's credential store maps credentials for the SSRF target host, those credentials are attached to the request (auth.Client looks up creds by request host)

The attacker cannot read the response body (it's parsed as JSON and fails), making this a blind SSRF. However, timing and error differences can confirm internal service existence.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

CVE-2026-85732 has a CVSS score of 4.7 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.6.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Validate that the URL returned by parseLink() has the same host and scheme as the original request before using it for the next pagination request. Reject cross-host or scheme-downgrade URLs.

1. What is CVE-2026-85732? CVE-2026-85732 is a medium-severity server-side request forgery (SSRF) vulnerability in oras.land/oras-go/v2 (go), affecting versions <= 2.6.1. It is fixed in 2.6.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. How severe is CVE-2026-85732? CVE-2026-85732 has a CVSS score of 4.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of oras.land/oras-go/v2 are affected by CVE-2026-85732? oras.land/oras-go/v2 (go) versions <= 2.6.1 is affected.
4. Is there a fix for CVE-2026-85732? Yes. CVE-2026-85732 is fixed in 2.6.2. Upgrade to this version or later.
5. Is CVE-2026-85732 exploitable, and should I be worried? Whether CVE-2026-85732 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-85732 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-85732? Upgrade oras.land/oras-go/v2 to 2.6.2 or later.

Other vulnerabilities in oras.land/oras-go/v2