CVE-2026-39822
Vulnerability Summary
Timeline
Description
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
CVSS Metrics
- v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.23%• Percentile: 14%
Techniques & Countermeasures
- CWE-61•UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Affected Systems
- chainguard•actionlint
< 0
- chainguard•actions-runner-controller
< 0.14.2-r5 | < 0
- chainguard•actions-runner-controller-fips
< 0 | < 0.14.2-r4
- chainguard•addon-resizer
< 0
- chainguard•addon-resizer-fips
< 0
- chainguard•age-fips
< 0 | < 1.3.1-r15
- chainguard•agentbeat
< 0
- chainguard•agentbeat-fips
< 0
- chainguard•amass
< 0
- chainguard•amazon-cloudwatch-agent
< 0
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 0
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-translator
< 0
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 0
- chainguard•amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-cloudwatch-agent-operator
< 0
- chainguard•amazon-cloudwatch-agent-operator-fips
< 0
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 0
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-ecs-agent
< 1.105.0-r2 | < 0
- chainguard•amazon-ecs-agent-fips
< 0 | < 1.105.0-r1
- chainguard•amazon-ecs-cni-plugins-fips
< 2024.9.0_git20260617-r3 | < 0
- chainguard•amazon-eks-ami
< 0
- chainguard•amazon-eks-ami-fips
< 0
- chainguard•amazon-k8s-cni
< 0 | < 1.22.3-r1
- chainguard•amazon-k8s-cni-fips
< 0 | < 1.22.3-r1
- chainguard•amazon-k8s-cni-init
< 0
- chainguard•amazon-k8s-cni-init-fips
< 0
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.22.3-r1
- chainguard•amazon-ssm-agent
< 3.3.4793.0-r1 | < 0
- chainguard•amazon-ssm-agent-ecs-exec
< 0 | < 3.3.4793.0-r1
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 0 | < 3.3.4793.0-r2
- chainguard•amazon-ssm-agent-fips
< 0 | < 3.3.4793.0-r2
- chainguard•amazon-vpc-cni-plugins-fips
< 0 | < 1.3_git20260619-r2
- chainguard•ansible-operator
< 0
- chainguard•ansible-operator-fips
< 0
- chainguard•apache-beam-java-11-sdk
< 0
- chainguard•apache-beam-java-17-sdk
< 0
- chainguard•apache-beam-java-21-sdk
< 0
- chainguard•apache-beam-python-3.11-sdk
< 0
- chainguard•apache-beam-python-3.13-sdk
< 0
- chainguard•apache-exporter
< 0
- chainguard•apiserver-network-proxy-fips-0.34
< 0
- chainguard•apiserver-network-proxy-fips-0.34-agent
< 0
- chainguard•apiserver-network-proxy-fips-0.35
< 0
- chainguard•apiserver-network-proxy-fips-0.35-agent
< 0
- chainguard•apiserver-network-proxy-fips-0.36
< 0
- chainguard•apiserver-network-proxy-fips-0.36-agent
< 0
Showing first 50 affected entries in server-rendered view.
References (21)
- https://go.dev/issue/79005
- https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- https://go.dev/cl/797880
- https://pkg.go.dev/vuln/GO-2026-4970
- https://access.redhat.com/errata/RHSA-2026:38493
- https://access.redhat.com/security/updates/classification/#important
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38493.json
- https://access.redhat.com/security/cve/CVE-2026-39822
- https://www.cve.org/CVERecord?id=CVE-2026-39822
- https://nvd.nist.gov/vuln/detail/CVE-2026-39822
- https://access.redhat.com/errata/RHSA-2026:38494
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38494.json
- https://access.redhat.com/errata/RHSA-2026:38495
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38495.json
- https://access.redhat.com/errata/RHSA-2026:38878
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38878.json
- https://security-tracker.debian.org/tracker/CVE-2026-39822
- https://www.suse.com/security/cve/CVE-2026-39822
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39822.json