StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
oras.land/oras-go/v2@v2.3.0
2.6.1

Open the chart page →

2,314
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed

Open the chart page →

2,505
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

30,687
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,360
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,322
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

2,477
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

696
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,650
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,407
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

13,677

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/kgma74/dockyard:0.4.0b40439329191
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
oras.land/oras-go@v1.2.0
no fix listed
1
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
oras.land/oras-go@v1.2.2
no fix listed
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
oras.land/oras-go@v1.2.2
no fix listed
1
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
oras.land/oras-go@v1.2.5
no fix listed
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
oras.land/oras-go@v1.2.5
no fix listed
1
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
oras.land/oras-go@v1.2.4
no fix listed
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
oras.land/oras-go@v1.1.0
no fix listed
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go@v1.2.2
oras.land/oras-go/v2@v2.2.0
no fix listed
2.6.1
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.1
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
oras.land/oras-go@v1.2.2
no fix listed
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
oras.land/oras-go/v2@v2.0.0
2.6.1
1
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
oras.land/oras-go@v0.4.0
no fix listed
1
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
oras.land/oras-go@v1.2.3
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
oras.land/oras-go@v1.1.0
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
oras.land/oras-go@v1.1.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.