CVE-2026-71556

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71556", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T21:24:15.376Z", "datePublished": "2026-08-07T16:37:40.058Z", "dateUpdated": "2026-08-07T16:58:19.113Z"}, "containers": {"cna": {"title": "go-git: Worktree operations may follow symlinks", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"}, {"name": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"}, {"name": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"}, {"name": "https://github.com/go-git/go-git/releases/tag/v5.19.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"}, {"name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"}], "affected": [{"vendor": "go-git", "product": "go-git", "versions": [{"version": "< 5.19.2", "status": "affected"}, {"version": ">= 6.0.0-alpha.1, < 6.0.0-alpha.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T16:37:40.058Z"}, "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."}], "source": {"advisory": "GHSA-hc8v-wwc9-vgxm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T16:58:08.599214Z", "id": "CVE-2026-71556", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T16:58:19.113Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71556", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T21:24:15.376Z", "datePublished": "2026-08-07T16:37:40.058Z", "dateUpdated": "2026-08-07T16:58:19.113Z"}, "containers": {"cna": {"title": "go-git: Worktree operations may follow symlinks", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"}, {"name": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"}, {"name": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"}, {"name": "https://github.com/go-git/go-git/releases/tag/v5.19.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"}, {"name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"}], "affected": [{"vendor": "go-git", "product": "go-git", "versions": [{"version": "< 5.19.2", "status": "affected"}, {"version": ">= 6.0.0-alpha.1, < 6.0.0-alpha.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T16:37:40.058Z"}, "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."}], "source": {"advisory": "GHSA-hc8v-wwc9-vgxm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T16:58:08.599214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T16:58:13.955Z"}}]}}

{"affected": [{"affectedData": [{"product": "go-git", "vendor": "go-git", "versions": [{"status": "affected", "version": "< 5.19.2"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.0.0-alpha.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."}], "id": "CVE-2026-71556", "lastModified": "2026-09-10T20:41:33.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71556", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T16:58:08.599214Z", "version": "2.0.3"}}]}, "published": "2026-08-07T17:17:10.150", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution", "id": "2512562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-59", "details": ["go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.", "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification."], "name": "CVE-2026-71556", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/assisted-installer-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/assisted-service-9-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/cluster-image-set-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/must-gather-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-must-gather-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/multicluster-operators-subscription-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-07T16:37:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71556\nhttps://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab\nhttps://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac\nhttps://github.com/go-git/go-git/releases/tag/v5.19.2\nhttps://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5\nhttps://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.19.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0-alpha.1,6.0.0-alpha.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "go-git", "source": "cna", "vendor": "go-git"}, "product": "go-git", "vendor": "go-git"}], "created": "2026-08-07T17:30:16.188290+00:00", "updated": "2026-08-07T18:45:02.164484+00:00", "vendors": ["go-git", "go-git$PRODUCT$go-git"]}