Read the docs
TI-2026-50128 Aliases CVE-2026-71556GHSA-hc8v-wwc9-vgxm

go-git: Worktree operations may follow symlinks

Priority LOW 31CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Partial Red Hat: 37 fixed, 26 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00357 29th percentileScored 2026-11-07
Fix Partial go-git (go-git): 5.19.2, 6.0.0-alpha.5github.com/go-git/go-git/v5 (Go): 5.19.2+1 more productRed Hat: 42 advisoriesRed Hat: 37 fixed, 26 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-gitbefore 5.19.2; 6.0.0-alpha.1 to before 6.0.0-alpha.55.19.2, 6.0.0-alpha.5Patch availableCNA
—github.com/go-git/go-git/v5 (Go)before 5.19.25.19.2Patch availableGHSA-hc8v-wwc9-vgxm
—github.com/go-git/go-git/v6 (Go)before 6.0.0-alpha.56.0.0-alpha.5Patch availableGHSA-hc8v-wwc9-vgxm
  • go-git Vendorgo-git Affected before 5.19.2; 6.0.0-alpha.1 to before 6.0.0-alpha.5 Fixed in 5.19.2, 6.0.0-alpha.5 Patch available CNA
  • github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.19.2 Fixed in 5.19.2 Patch available GHSA-hc8v-wwc9-vgxm
  • github.com/go-git/go-git/v6 (Go) Vendor— Affected before 6.0.0-alpha.5 Fixed in 6.0.0-alpha.5 Patch available GHSA-hc8v-wwc9-vgxm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:*:*:*——go-git
  • cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:*:*:* Versions — — ·go-git

Remediation

  • Fix · CNA go-git (go-git) Fixed in 5.19.2, 6.0.0-alpha.5
  • Fix · GHSA-hc8v-wwc9-vgxm github.com/go-git/go-git/v5 (Go) Fixed in 5.19.2 Advisory →
  • Fix · GHSA-hc8v-wwc9-vgxm github.com/go-git/go-git/v6 (Go) Fixed in 6.0.0-alpha.5 Advisory →

Red Hat 42 advisories

  • RHSA-2026:94094 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.15.3 release.
    • Red Hat Web Terminal 1.15 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94074 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.14.2 release.
    • Red Hat Web Terminal 1.14 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94073 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.17.2 release.
    • Red Hat Web Terminal 1.17 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
Show 39 more Red Hat advisories
  • RHSA-2026:94072 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.11.3 release.
    • Red Hat Web Terminal 1.11 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94071 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.16.3 release.
    • Red Hat Web Terminal 1.16 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94070 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.13.2 release.
    • Red Hat Web Terminal 1.13 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:93938 Released 2026-11-02 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:90337 Released 2026-10-26 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.6 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:90323 Released 2026-10-26 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.9 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83597 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:74609 Released 2026-10-01 · Red Hat rating Important
    Cluster Observability Operator 1.5.3
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +13
  • RHSA-2026:73399 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.18 Images
    • Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73380 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73262 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73261 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73197 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73194 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel8
  • RHSA-2026:73193 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:73165 Released 2026-09-29 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/cnv-must-gather-rhel9
  • RHSA-2026:70828 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:69945 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69928 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69539 Released 2026-09-21 · Red Hat rating Important
    RHOAI 3.5.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +28
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:68335 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • RHEM 1.2 for RHEL 10 flightctl-1.2.1-1.el10, flightctl-agent-1.2.1-1.el10, flightctl-cli-1.2.1-1.el10
    • RHEM 1.2 for RHEL 9 flightctl-1.2.1-1.el9, flightctl-agent-1.2.1-1.el9, flightctl-cli-1.2.1-1.el9
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:67543 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +3
  • RHSA-2026:67542 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67541 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
  • RHSA-2026:67540 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:66421 Released 2026-09-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.74.0-0.2.hum1@aarch64, trivy-0.74.0-0.2.hum1@src, trivy-0.74.0-0.2.hum1@x86_64
  • RHSA-2026:66363 Released 2026-09-10 · Red Hat rating Important
    external secrets operator for Red Hat OpenShift 1.2.1
    • external secrets operator for Red Hat OpenShift 1.2 registry.redhat.io/external-secrets-operator/external-secrets-rhel9
  • RHSA-2026:66208 Released 2026-09-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images kube-state-metrics-2.20.0-0.2.hum1@aarch64, kube-state-metrics-2.20.0-0.2.hum1@src, kube-state-metrics-2.20.0-0.2.hum1@x86_64
  • RHSA-2026:60793 Released 2026-08-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grype-0.118.0-0.1.hum1@aarch64, grype-0.118.0-0.1.hum1@src, grype-0.118.0-0.1.hum1@x86_64
  • RHSA-2026:60646 Released 2026-08-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images syft-1.51.1-0.1.hum1@aarch64, syft-1.51.1-0.1.hum1@src, syft-1.51.1-0.1.hum1@x86_64
  • RHSA-2026:50953 Released 2026-08-06 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images trivy-0.73.0-0.1.hum1@aarch64, trivy-0.73.0-0.1.hum1@src, trivy-0.73.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Compliance OperatorAffectedNo fix yet
DPU kit for NVIDIAAffectedNo fix yet
Exploit IntelligenceAffectedNo fix yet
Kernel Module Management Operator for Red Hat OpenshiftAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Machine Deletion Remediation OperatorAffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:74609
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
RHEM 1.2 for RHEL 10Fixed RHSA-2026:68335
RHEM 1.2 for RHEL 9Fixed RHSA-2026:68335
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:67538
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:67540
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:67539
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:67541
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:67542
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:67543
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:73194
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:73197
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:73261
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:93938
Red Hat Container Native Virtualization 4.18Fixed RHSA-2026:73399
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:73193
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:73380
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:73262
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:73165
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Hardened ImagesFixed RHSA-2026:50953, RHSA-2026:60646, RHSA-2026:60793, RHSA-2026:66208, RHSA-2026:66421
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:69539
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:69945
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:90323
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:90337
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:70828
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83597
Red Hat Web Terminal 1.11Fixed RHSA-2026:94072
Red Hat Web Terminal 1.13Fixed RHSA-2026:94070
Red Hat Web Terminal 1.14Fixed RHSA-2026:94074
Red Hat Web Terminal 1.15Fixed RHSA-2026:94094
Red Hat Web Terminal 1.16Fixed RHSA-2026:94071
Red Hat Web Terminal 1.17Fixed RHSA-2026:94073
external secrets operator for Red Hat OpenShift 1.2Fixed RHSA-2026:66363
Not affected: 53 products
  • Builds for Red Hat OpenShift
  • Cluster Observability Operator 1.5
  • Confidential Compute Attestation
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logical Volume Manager Storage
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • OpenShift Developer Tools and Services
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Kueue
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Workspaces Operator
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat Web Terminal 1.11
  • Red Hat Web Terminal 1.13
  • Red Hat Web Terminal 1.14
  • Red Hat Web Terminal 1.15
  • Red Hat Web Terminal 1.16
  • Red Hat Web Terminal 1.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71556
  2. 2026-10-03 Alias added: GHSA-hc8v-wwc9-vgxm
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83597 · Red Hat
  6. 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
  7. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  8. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  9. 2026-10-23 Affected versions changed · Red Hat
  10. 2026-10-26 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
  11. 2026-10-27 Affected versions changed · Red Hat
  12. 2026-10-29 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21 · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:90323 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:90337 · Red Hat
  15. 2026-10-30 Affected versions changed · Red Hat
  16. 2026-11-03 Fix available: RHSA-2026:94094 · Red Hat
  17. 2026-11-03 Fix available: RHSA-2026:94074 · Red Hat
  18. 2026-11-03 Fix available: RHSA-2026:94072 · Red Hat
  19. 2026-11-03 Fix available: RHSA-2026:94071 · Red Hat
  20. 2026-11-03 Fix available: RHSA-2026:94070 · Red Hat
  21. 2026-11-03 Fix available: RHSA-2026:94073 · Red Hat
  22. 2026-11-03 Fix available: RHSA-2026:93938 · Red Hat
  23. 2026-11-03 Fix available: Red Hat Container Native Virtualization 4.17, Red Hat Web Terminal 1.11, Red Hat Web Terminal 1.13 +4 · Red Hat
  24. 2026-11-04 Affected versions changed · Red Hat
  25. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Other 6

  • TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
  • TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2026-32835 Billy: Path traversal vulnerabilities CVSS 3.1HIGH 8.1
  • TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences