< Back

CVE-2026-85732

Updated on 16 Sep 2026

Severity

4.7 Medium severity

Details

CVSS score
4.7
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Details

Affected product:
argocd , oras-project/oras-go
Affected packages:
oras.land/oras-go @ 2.5.0 (+1 more)