CVE-2026-50163: 
Trivy vulnerability analysis and mitigation

CVE-2026-50163 is a hardlink path traversal vulnerability in oras-go, the Go library for managing OCI artifacts, that allows a malicious OCI artifact to escape the extraction directory by exploiting process current working directory (CWD) resolution. The flaw exists in versions up to and including v2.6.1 of the oras.land/oras-go/v2 module; it is fixed in v2.6.2. The vulnerability was first published by researcher anvanster on June 11, 2026, and added to the GitHub Advisory Database on July 1, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, GHSA Security Advisory).

The root cause is a logic error in ensureLinkPath (content/file/utils.go:262-275), classified as CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution Before File Access). The function validates a hardlink's target by resolving relative paths against the link file's directory, but then returns the original, unresolved target string to the caller. The caller passes this unresolved string to os.Link(), which wraps the link(2) syscall; per POSIX, link(2) resolves relative paths against the process CWD — not the link file's directory. An attacker who controls an OCI registry crafts a tarball layer with a TypeLink entry (e.g., Name=payload.tar.gz/evil_cwd_link, Linkname="victim.secret") and annotates the layer descriptor with io.deis.oras.content.unpack: "true" to trigger auto-extraction. When the victim runs oras pull, validation passes (the resolved path appears inside the extract base), but os.Link("victim.secret", "<extract_base>/evil_cwd_link") resolves victim.secret against the process CWD, creating a hardlink inside the extract tree that shares an inode with an arbitrary CWD file (GHSA Security Advisory, Fix PR).

The primary impact is an arbitrary CWD-file read primitive: any file the invoking user owns or has write access to in the process CWD (e.g., .env, .git/config, .aws/credentials, ~/.ssh/config) can be hardlinked into the extract tree and read by the attacker or any process that later accesses the extract directory. A secondary integrity impact exists because the shared inode means any write, chmod, or truncation of the extract-tree hardlink also modifies the original CWD file, violating the containment invariant relied upon by CI systems and container-image builders. When oras pull runs as root (e.g., in Kubernetes operators, Flux source-controller, or container entrypoints), the reachable file set expands to the entire host filesystem, including /etc/shadow and service private keys, making the impact effectively critical in those contexts (Github Advisory).

A proof-of-concept (PoC) is publicly available and was included in the original advisory, tested on Ubuntu 24.04.4 LTS with oras CLI v1.3.0; NVD's SSVC assessment also classifies exploitation status as "poc" (GHSA Security Advisory). Exploitation requires user interaction — the victim must pull from an attacker-controlled OCI registry — but requires no privileges on the attacker's side. The EPSS score is approximately 0.345% (27th percentile), indicating low but non-negligible probability of exploitation in the near term. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory).

1. Set up a malicious OCI registry: The attacker controls or compromises an OCI-compliant registry accessible to the target victim.
2. Craft a malicious tarball layer: Using Python's tarfile module (or equivalent), create a .tar.gz with two entries: a regular file (e.g., payload.tar.gz/README.txt) and a TypeLink (hardlink) entry with Name=payload.tar.gz/evil_cwd_link and a relative Linkname="victim.secret" (the name of a sensitive file expected in the victim's CWD).
3. Annotate the layer descriptor: Push the artifact to the OCI layout and patch the manifest to add the annotation io.deis.oras.content.unpack: "true" on the layer descriptor, instructing oras-go to auto-extract the tarball.
4. Lure the victim to pull: Trick the victim into running oras pull <attacker-registry>/malicious-artifact from a working directory containing the target file (e.g., a CI workspace with .env or .aws/credentials).
5. Extraction triggers the bug: During extraction, ensureLinkPath validates the hardlink target as safe (resolving against the link file's directory), but returns the unresolved relative string "victim.secret". os.Link("victim.secret", "<extract_base>/evil_cwd_link") then resolves victim.secret against the process CWD via link(2), creating a hardlink inside the extract tree that shares an inode with the victim's CWD file.
6. Exfiltrate or tamper: Read the extract-tree hardlink to obtain the contents of the victim's CWD file, or write to it to tamper with the original file through the shared inode (GHSA Security Advisory, Github Advisory).

• File System: Unexpected hardlinks inside an oras pull extraction directory (files with inode numbers matching files in the invoking process's CWD); verify with stat -c '%i' on extracted files and compare against CWD files. Presence of files like .env, .git/config, .aws/credentials, or .ssh/config appearing as hardlinks within an OCI artifact extract directory.
• Logs: CI/CD pipeline logs showing oras pull commands executed from workspace directories containing credential files; unexpected file access or read events on sensitive CWD files immediately following an oras pull invocation (detectable via auditd or inotifywait).
• Network: Outbound oras pull connections to unfamiliar or newly registered OCI registries; artifact manifests containing the annotation io.deis.oras.content.unpack: "true" on layers that include TypeLink (hardlink) tar entries with relative Linkname values (inspect with oras manifest fetch and layer blob inspection).
• Process: oras or Go processes invoking link(2) syscalls where the oldpath argument is a relative path not prefixed with the extraction directory path (detectable via strace -e trace=link or eBPF-based syscall monitoring) (GHSA Security Advisory).

Upgrade oras.land/oras-go/v2 to v2.6.2 or later, which resolves relative hardlink targets against filepath.Dir of the link file before calling os.Link, preventing CWD-based escape (v2.6.2 Release, Fix PR). IBM Sterling Order Management System Software users should apply the vendor-provided patch referenced in IBM's security bulletin (IBM Advisory). As a short-term workaround where upgrading is not immediately possible, avoid running oras pull from directories containing sensitive files, or ensure the process CWD is set to an empty temporary directory before invoking any oras-go-based artifact extraction.

The fix was authored and backported to the v2 release line by Terry Howe (oras-project maintainer) and merged on July 3, 2026, with the v2.6.2 security patch release following on July 10, 2026 (Fix PR, v2.6.2 Release). The vulnerability was picked up by OpenSUSE security announcements and downstream projects such as pulumi-kubernetes and argocd-cluster-register, which issued dependency update PRs shortly after disclosure. Community commentary noted the supply-chain risk for CI pipelines and Kubernetes/GitOps tooling, with one community member asking about the v2.7.0 release timeline in the fix PR discussion.