StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
oras.land/oras-go/v2@v2.3.0
2.6.1

Open the chart page →

2,314
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed

Open the chart page →

2,505
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

30,687
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,360
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,322
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

2,477
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

696
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,650
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,407
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

13,677

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
prowlercloud/prowler-api:5.31.14f252d579be2
oras.land/oras-go/v2@v2.6.0
2.6.1
1
replicated/replicated-sdk:1.0.0-beta.318751b4963250
oras.land/oras-go@v1.2.5
no fix listed
1
ryuunosukeds3/orbital:latest0879f7261b10
oras.land/oras-go/v2@v2.5.0
2.6.1
1
semaphoreui/semaphore:latest:v2.19.123996804607eb
oras.land/oras-go/v2@v2.6.0
2.6.1
1
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
oras.land/oras-go/v2@v2.6.0
2.6.1
1
semaphoreui/semaphore:v2.18.3e9260bfa8255
oras.land/oras-go/v2@v2.6.0
2.6.1
1
sikalabs/slu:v0.72.07bd267f30247
oras.land/oras-go/v2@v2.3.0
2.6.1
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
oras.land/oras-go@v1.2.5
no fix listed
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
oras.land/oras-go@v1.1.0
no fix listed
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/appscode/kube-ui-server:v0.7.079e67164b4f0
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
oras.land/oras-go/v2@v2.0.2
2.6.1
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
1
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/caninehq/canine:latesta058034ca006
oras.land/oras-go@v1.2.6
no fix listed
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
oras.land/oras-go@v1.2.0
no fix listed
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.3bdb31f3121a2
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/clusternet/clusternet-controller-manager:v1.0.02ce077d3d02d
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/headlamp-k8s/headlamp:v0.43.05d03caa26df7
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/helm/chartmuseum:v0.16.071d1f1c0179e
oras.land/oras-go@v1.2.2
no fix listed
1
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
oras.land/oras-go@v1.1.1
no fix listed
1
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/keel-hq/keel:0.22.3315e188a07c2
oras.land/oras-go@v1.2.5
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.