Go-getter may allow to arbitrary filesystem reads through git operations
Priority LOW 34CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00593 48th percentileScored 2026-11-07
Fix Partial Tooling (HashiCorp): 1.8.6github.com/hashicorp/go-getter (Go): 1.8.6Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HashiCorp | Tooling | before 1.8.6 | 1.8.6 | Patch available | CNA |
| — | github.com/hashicorp/go-getter (Go) | before 1.8.6 | 1.8.6 | Patch available | GHSA-92mm-2pjq-r785 |
- Tooling VendorHashiCorp Affected before 1.8.6 Fixed in 1.8.6 Patch available CNA
- github.com/hashicorp/go-getter (Go) Vendor— Affected before 1.8.6 Fixed in 1.8.6 Patch available GHSA-92mm-2pjq-r785
Remediation
- Fix · CNA Tooling (HashiCorp) Fixed in 1.8.6
- Fix · GHSA-92mm-2pjq-r785 github.com/hashicorp/go-getter (Go) Fixed in 1.8.6 Advisory →
Red Hat 1 advisory
- RHSA-2026:24478 Released 2026-06-08 · Red Hat rating ImportantRHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/client-server-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:24478 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 4
- Red Hat Trusted Artifact Signer
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4660
- 2026-10-03 Alias added: GHSA-92mm-2pjq-r785
References
More HashiCorp vulnerabilities
- TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
- TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
- TI-2026-06570 Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVSS 3.1HIGH 8.8
- TI-2020-17753 The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root… CVSS 3.1CRITICAL 9.8
- TI-2026-13641 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
- TI-2026-13778 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-4660 · CVE Program
- CVE-2026-4660 · NVD
- FIRST EPSS
- GHSA-92mm-2pjq-r785 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-4660 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences