Skip to content
Fencer Vulns
high 7.1

CVE-2026-50163 json

oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

published 2026-07-01 4 mo ago modified 2026-10-24 15 d ago also GHSA-fxhp-mv3v-67qp , GO-2026-5880 , EUVD-2026-45297

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

Patch / fix

  • go oras.land/oras-go/v2 2.6.2
  • golang-oras-oras-go Debian 14 2.6.2-1

debian advisories DEBIAN-CVE-2026-50163

  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.3.0-160000.1.1
  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1

suse advisories SUSE-SU-2026:24282-1SUSE-SU-2026:23973-1SUSE-SU-2026:23984-1SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1

  • helm openSUSE Leap 16.0 4.3.0-160000.1.1
  • trivy openSUSE Leap 16.0 0.74.0-160000.2.1
  • trivy openSUSE Tumbleweed 0.74.0-2.1
  • helm openSUSE Tumbleweed 4.2.4-1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1
  • oras openSUSE Tumbleweed 1.3.3-2.1

opensuse advisories openSUSE-SU-2026:21983-1openSUSE-SU-2026:21801-1openSUSE-SU-2026:11676-1openSUSE-SU-2026:11575-1openSUSE-SU-2026:21551-1openSUSE-SU-2026:11297-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-50163 updated cvss 5.9

oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks

  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicluster-operators-subscription-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-ai-gateway-operator-rhel9, rhoai/odh-ogx-module-operator-rhel9, rhoai/odh-kserve-module-operator-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/cnf-tests-rhel8, openshift4/ose-console-rhel9, openshift4/ose-helm-operator, openshift4/ose-ansible-operator, openshift4/ose-olm-rukpak-rhel8, +17 more
    +4 more products
    Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/metallb-rhel9-operator Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle, rhoso-operators/rabbitmq-cluster-rhel9-operator
    affected: workaround, no fix available “Upgrade to oras-go v2.6.1 or later.”
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1785413210
    fixed: vendor fix “Upgrade to oras-go v2.6.1 or later.” RHSA-2026:48872
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1785420959
    fixed: vendor fix “Upgrade to oras-go v2.6.1 or later.” RHSA-2026:48913
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-roxctl-rhel8 1785413210, advanced-cluster-security/rhacs-scanner-rhel8 1784788409, advanced-cluster-security/rhacs-rhel8-operator 1785413210, advanced-cluster-security/rhacs-collector-rhel8 1784283534, advanced-cluster-security/rhacs-operator-bundle 1785413210, advanced-cluster-security/rhacs-central-db-rhel8 1785413210, +5 more Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-fact-rhel8 1784294375, advanced-cluster-security/rhacs-roxctl-rhel8 1785420959, advanced-cluster-security/rhacs-scanner-rhel8 1784785682, advanced-cluster-security/rhacs-rhel8-operator 1785420959, advanced-cluster-security/rhacs-collector-rhel8 1784282883, advanced-cluster-security/rhacs-operator-bundle 1785420959, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
GitHub 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go oras.land/oras-go/v2
<2.6.2
2.6.2

Affected products

  • oras-project oras-go

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.