THREAT OPS › Threat News › [GHSA] GHSA-h7vf-4x9w-h99v (medium) — oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
[GHSA] GHSA-h7vf-4x9w-h99v (medium) — oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
GHSA-h7vf-4x9w-h99v Severity: medium CVE: CVE-2026-85732
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
## Summary
oras-go's pagination helper `parseLink()` in `registry/remote/utils.go` follows the `Link` response header from a registry without validating the URL's host or scheme. When a malicious registry returns a `Link` header containing an
MITRE ATT&CK techniques
- CredentialsT1589.001
- Malicious LinkT1204.001
- Malicious LinkAML.T0011.003
Indicators of compromise
- CVE-2026-85732cve
- http://internal-service:8080/adminurl
- attacker-registry.iodomain
Original source: https://github.com/advisories/GHSA-h7vf-4x9w-h99v