StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
oras.land/oras-go/v2@v2.3.0
2.6.1

Open the chart page →

2,314
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed

Open the chart page →

2,505
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

30,687
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,360
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,322
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

2,477
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

696
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,650
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,407
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

13,677

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
artifacthub/scanner:v1.19.0323d026e78c3
oras.land/oras-go@v1.2.5
no fix listed
1
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
artifacthub/tracker:v1.19.06596c8c4d955
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-agent:v3.0.5d24c323fe7c3
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-helm:v3.0.1b4d9f9bee224
oras.land/oras-go@v1.2.2
no fix listed
1
devopstales/trivy-operator:2.575136aa7a26e
oras.land/oras-go@v1.1.1
no fix listed
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
oras.land/oras-go@v1.2.2
no fix listed
1
epamedp/edp-headlamp:0.25.093417e18bb1a
oras.land/oras-go@v1.2.4
no fix listed
1
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.1
1
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flanksource/batch-runner:v1.0.44689687a7cf95
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flomesh/fsm-manager:0.2.1122f849c70b25
oras.land/oras-go@v1.2.2
no fix listed
1
galaxy/cloudman-server:lateste5c265fe9fcd
oras.land/oras-go@v1.2.0
no fix listed
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
oras.land/oras-go@v1.1.0
no fix listed
1
goharbor/harbor-core:v2.5.386bf3031f4a7
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
oras.land/oras-go@v1.1.1
no fix listed
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed
1
hashicorp/waypoint:0.11.397d521a27498
oras.land/oras-go@v1.2.0
no fix listed
1
inseefrlab/shelly:cloudshell31f04ca7436b
oras.land/oras-go@v1.2.4
no fix listed
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
oras.land/oras-go/v2@v2.6.0
2.6.1
1
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.1
1
kubebb/core:v0.1.62b9e7f451d6b
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/core:lateste366c34a9b8d
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
oras.land/oras-go@v1.2.0
no fix listed
1
kubesphere/ks-extensions-museum:latest29681958f220
oras.land/oras-go@v1.2.3
no fix listed
1
kubesphere/kubectl:v1.27.1649b445b1b732
oras.land/oras-go@v1.2.2
no fix listed
1
kusionstack/kusion:v0.14.0126c8f0b0976
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
oras.land/oras-go@v1.2.0
no fix listed
1
layer5/meshery-consul:stable-latest25a4cc38abcd
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-istio:stable-latestfde47c141ec6
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-kuma:stable-latest9d25f029a8a2
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-osm:stable-latestec898e5786c6
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
oras.land/oras-go@v1.2.2
no fix listed
1
logiqai/flash:v3.10.265b996bc7bdc
oras.land/oras-go@v1.2.4
no fix listed
1
mavrick1/kubestellar-b:latest45ca0429a1d4
oras.land/oras-go@v1.2.5
no fix listed
1
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.1
1
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.1
1
phntom/chartmuseum:v0.16.053883b65d9b7
oras.land/oras-go@v1.2.2
no fix listed
1
phntom/chartmuseum:v0.15.29242b4df9e65
oras.land/oras-go@v1.2.0
no fix listed
1
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.1
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
oras.land/oras-go@v1.2.5
no fix listed
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.1
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
oras.land/oras-go@v1.2.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.