Is CVE-2026-50163 in the CISA Known Exploited Vulnerabilities catalog?

CVE-2026-50163 is not currently listed in the CISA KEV catalog.

Vulnerability intelligence

CVE-2026-50163

ORAS Go and Java SDKs — used by Azure ACR, AWS ECR, Docker Hub, Helm, and Notation — disclosed symlink and hardlink escape flaws that let a malicious artifact write files outside the extraction directory.

2026

What WebPulse reported · 1 analysis

Three Path Traversal CVEs Hit the Libraries That Move Every OCI Artifact

ORAS Go and Java SDKs — used by Azure ACR, AWS ECR, Docker Hub, Helm, and Notation — disclosed symlink and hardlink escape flaws that let a malicious artifact w

July 2, 2026

View CVE-2026-50163 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2026-9082 CVE-2026-8206 CVE-2026-48019 CVE-2026-35273 CVE-2026-11645 CVE-2026-8181 CVE-2026-47291 CVE-2026-45657