CVE-2026-114466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114466", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-21T15:02:45.478Z", "datePublished": "2026-11-12T13:13:00.071Z", "dateUpdated": "2026-11-12T13:13:00.071Z"}, "containers": {"cna": {"title": "Insufficient Granularity of Access Control in Git", "descriptions": [{"lang": "en", "value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}], "affected": [{"vendor": "Git", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "versions": [{"version": "2.50.1", "status": "affected"}, {"version": "2.51.2", "status": "affected"}, {"version": "2.52.0", "status": "affected"}, {"version": "2.53.0", "status": "affected"}, {"version": "2.54.0", "status": "affected"}, {"version": "2.55.0", "status": "affected"}, {"version": "2.56.0", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1220: Insufficient Granularity of Access Control", "cweId": "CWE-1220", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/git/-/work_items/812"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."}], "credits": [{"lang": "en", "value": "ehdgks0627, un3xploitable", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-12T13:13:00.071Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "vendor": "Git", "versions": [{"status": "affected", "version": "2.50.1"}, {"status": "affected", "version": "2.51.2"}, {"status": "affected", "version": "2.52.0"}, {"status": "affected", "version": "2.53.0"}, {"status": "affected", "version": "2.54.0"}, {"status": "affected", "version": "2.55.0"}, {"status": "affected", "version": "2.56.0"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}], "id": "CVE-2026-114466", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-12T14:17:23.203", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/git/-/work_items/812"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1220"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "git: git: Arbitrary file system access via fast-import features", "id": "2567429", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567429"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-73", "details": ["A flaw was found in Git. Certain features within the fast-import utility do not properly restrict file system operations, allowing access to arbitrary paths outside the intended directory. By supplying crafted fast-import instructions, an attacker can access arbitrary file paths on the host system, potentially leading to unauthorized data disclosure or modification."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114466", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114466\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114466"], "statement": "Red Hat rates this vulnerability as Important because processing untrusted repository migration streams can allow unauthorized access across the underlying filesystem outside the intended repository boundaries. In typical Red Hat Enterprise Linux and containerized environments, Git is broadly integrated into continuous integration systems and developer workspaces. Although standard version control operations do not regularly utilize these specialized stream ingestion capabilities, services that process untrusted external data streams may expose host or container files to arbitrary path traversal under the execution context of the running user.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git"}], "created": "2026-11-11T19:15:17.094142+00:00", "updated": "2026-11-13T06:00:08.958969+00:00", "vendors": ["git", "git$PRODUCT$git"]}