CVE-2026-41506: go-git Credential leak via cross-host redirect in smart HTTP transport

Analyzed

AliasesRHSA-2026:17669UBUNTU-CVE-2026-41506DEBIAN-CVE-2026-41506+561 more

Published 08-05-2026Last modified 11-05-2026

Vulnerability summary

CVE-2026-41506 is a high (CVSS 7.4) Insufficiently Protected Credentials vulnerability in go-git_project go-git. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.6% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.4/10

010

High · v3.1 (NVD)

EPSS score

0.26%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

08-05-2026
PublishedVulnerability first disclosed.
11-05-2026
Last modifiedVulnerability information updated.

Description

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

CVSS metrics

8 scores · 8 sources · 1 version

v3.17.4

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

act< 0.2.87-r3
amazon-ssm-agent< 3.3.3270.0-r13
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r13
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r14
amazon-ssm-agent-fips< 3.3.3270.0-r14

apko< 1.2.3-r1
apko-fips< 1.2.3-r1
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.15-r1
argo-cd-3.1-compat< 3.1.15-r1
argo-cd-3.2< 3.2.10-r1
argo-cd-3.2-compat< 3.2.10-r1
argo-cd-3.3-compat< 3.3.7-r2
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.13-r6
argo-cd-fips-3.1-compat< 3.1.13-r6
argo-cd-fips-3.2< 3.2.8-r5
argo-cd-fips-3.2-compat< 3.2.8-r5
argo-cd-fips-3.3< 3.3.8-r2
argo-cd-fips-3.3-compat< 3.3.8-r2
argo-events< 1.9.10-r16
argo-events-fips< 1.9.10-r11
argo-workflow-executor-3.6< 3.6.19-r6
argo-workflow-executor-3.7< 3.7.13-r2
argo-workflow-executor-4.0< 4.0.4-r6
argo-workflow-executor-fips-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.7< 3.7.13-r6
argo-workflow-executor-fips-4.0< 4.0.4-r6
argo-workflows-3.6< 3.6.19-r6
argo-workflows-3.7< 3.7.13-r2
argo-workflows-4.0< 4.0.4-r6
argo-workflows-fips-3.6< 3.6.19-r7
argo-workflows-fips-3.7< 3.7.13-r6
argo-workflows-fips-4.0< 4.0.4-r6
argocd-image-updater< 1.1.1-r9
argocd-image-updater-fips< 1.1.1-r11
bom< 0.7.1-r15
cerbos< 0.51.0-r18
cerbos-fips< 0.51.0-r12
cerbosctl< 0.51.0-r18
cerbosctl-fips< 0.51.0-r12
cg< 0.2.245-r0
chainctl< 0.2.248-r0
chainctl-fips< 0.2.247-r0
chainloop-cli< 1.93.3-r1
chainloop-cli-fips< 1.93.3-r1
cloudbeat-8.17< 8.17.10-r13
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-8.19< 8.19.13-r9
cloudbeat-9.0< 9.0.8-r15
cloudbeat-9.1< 9.1.10-r9
cloudbeat-9.2< 9.2.7-r6
cloudbeat-9.3< 9.3.3-r4
cloudbeat-fips-8.17< 8.17.10-r19
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-8.19< 8.19.13-r8
cloudbeat-fips-9.0< 9.0.8-r16
cloudbeat-fips-9.1< 9.1.10-r13
cloudbeat-fips-9.2< 9.2.7-r9
cloudbeat-fips-9.3< 9.3.2-r9
commercial-chainloop-cli< 1.72.2-r0
commercial-grafana-12.1All versions (No fix recorded)
crossplane-1.20-crank< 1.20.5-r10
crossplane-2.0-crank< 2.0.7-r11
crossplane-2.1-crank< 2.1.4-r12
crossplane-2.2-crank< 2.2.0-r9
crossplane-fips-1.20-crank< 1.20.5-r11
crossplane-fips-2.0-crank< 2.0.7-r13
crossplane-fips-2.1-crank< 2.1.4-r13
crossplane-fips-2.2-crank< 2.2.0-r11
dagger< 0.20.6-r2
external-secrets-operator-0.20All versions (No fix recorded)
external-secrets-operator-1.0All versions (No fix recorded)
external-secrets-operator-1.1All versions (No fix recorded)
external-secrets-operator-1.2All versions (No fix recorded)
external-secrets-operator-1.3All versions (No fix recorded)
external-secrets-operator-2.0< 2.0.1-r12
external-secrets-operator-2.1< 2.1.0-r12
external-secrets-operator-2.2< 2.2.0-r4
external-secrets-operator-2.3< 2.3.0-r1
external-secrets-operator-fips-0.20All versions (No fix recorded)
external-secrets-operator-fips-1.0All versions (No fix recorded)
external-secrets-operator-fips-1.1All versions (No fix recorded)
external-secrets-operator-fips-1.2All versions (No fix recorded)
external-secrets-operator-fips-1.3All versions (No fix recorded)
external-secrets-operator-fips-2.0< 2.0.1-r12
external-secrets-operator-fips-2.1< 2.1.0-r11
external-secrets-operator-fips-2.2< 2.2.0-r4
external-secrets-operator-fips-2.3< 2.3.0-r1
flux-2.5< 2.5.1-r26
flux-2.6< 2.6.4-r20
flux-2.7< 2.7.5-r14
flux-2.8< 2.8.5-r3
flux-fips-2.5< 2.5.1-r24
flux-fips-2.6< 2.6.4-r19
flux-fips-2.7< 2.7.5-r13
flux-fips-2.8< 2.8.5-r2
flux-image-automation-controller< 1.1.1-r12
flux-image-automation-controller-fips< 1.1.1-r4
flux-source-controller< 1.8.2-r5
flux-source-controller-fips< 1.8.2-r4
gitaly-18.10< 18.10.4-r3
gitaly-18.11< 18.11.2-r2
gitaly-18.6All versions (No fix recorded)
gitaly-18.7All versions (No fix recorded)
gitaly-18.8All versions (No fix recorded)
gitaly-18.9< 18.9.6-r3
gitaly-fips-18.10< 18.10.4-r1
gitaly-fips-18.11< 18.11.2-r1
gitaly-fips-18.6All versions (No fix recorded)
gitaly-fips-18.7All versions (No fix recorded)
gitaly-fips-18.8All versions (No fix recorded)
gitaly-fips-18.9< 18.9.6-r1
gitea< 1.25.5-r5
gitea-fips< 1.25.5-r4
gitlab-rails-ce-18.1< 18.1.6-r12
gitlab-rails-ce-18.10< 18.10.5-r2
gitlab-rails-ce-18.11< 18.11.2-r2
gitlab-rails-ce-18.3All versions (No fix recorded)
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9< 18.9.6-r1
gitlab-rails-ce-fips-18.1< 18.1.6-r12
gitlab-rails-ce-fips-18.10< 18.10.4-r2
gitlab-rails-ce-fips-18.11< 18.11.2-r2
gitlab-rails-ce-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9< 18.9.6-r1
gitlab-runner-18.10< 18.10.1-r3
gitlab-runner-18.11< 18.11.2-r0 | < 18.11.1-r1
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-18.7All versions (No fix recorded)
gitlab-runner-18.8All versions (No fix recorded)
gitlab-runner-18.9< 18.9.0-r8
gitlab-runner-fips-18.10< 18.10.1-r3
gitlab-runner-fips-18.11< 18.11.2-r1
gitlab-runner-fips-18.7All versions (No fix recorded)
gitlab-runner-fips-18.8All versions (No fix recorded)
gitlab-runner-fips-18.9< 18.9.0-r7
gitlab-runner-helper-18.10< 18.10.1-r3
gitlab-runner-helper-18.11< 18.11.2-r0
gitlab-runner-helper-18.6All versions (No fix recorded)
gitlab-runner-helper-18.7All versions (No fix recorded)
gitlab-runner-helper-18.8All versions (No fix recorded)
gitlab-runner-helper-18.9< 18.9.0-r8
gitlab-runner-helper-fips-18.10< 18.10.1-r3
gitlab-runner-helper-fips-18.11< 18.11.2-r1
gitlab-runner-helper-fips-18.7All versions (No fix recorded)
gitlab-runner-helper-fips-18.8All versions (No fix recorded)
gitlab-runner-helper-fips-18.9< 18.9.0-r7
gitsign< 0.14.0-r18
gomplate-4< 4.3.3-r11
gomplate-5< 5.0.0-r17
gomplate-fips-4< 4.3.3-r11
gomplate-fips-5< 5.0.0-r14
google-osconfig-agent< 20251028.00-r15
goreleaser< 2.15.3-r2
gptscript< 0.9.9-r113 | < 0.9.9-r108
grafana-12.0All versions (No fix recorded)
grafana-12.1< 12.1.10.01-r6
grafana-alloy< 1.15.1-r3
grafana-alloy-fips< 1.15.1-r2
grafana-fips-12.0All versions (No fix recorded)
grafana-fips-12.1< 12.1.9-r9
grype< 0.111.0-r4
grype-db< 0.53.1-r4
grype-fips< 0.111.0-r3
guac< 1.1.0-r6
guacingest< 1.1.0-r6
guacone< 1.1.0-r6
jfrog-cli< 2.101.0-r0
k9s< 0.50.18-r20
k9s-fips< 0.50.18-r16
kaniko< 1.25.13-r1
kaniko-fips< 1.25.13-r1
kargo< 1.9.6-r3
kots< 1.130.0-r7
kubescape< 4.0.5-r2
kubescape-server< 4.0.5-r1
kubescape-server-downloader< 4.0.5-r1
kubescape-server-fips< 4.0.5-r1
kubescape-server-fips-downloader< 4.0.5-r1
kubevela-vela-cli< 1.10.8-r3
kubevela-vela-cli-fips< 1.10.8-r4
kubevela-vela-core< 1.10.8-r3
kubevela-vela-core-fips< 1.10.8-r4
kyverno-cli-1.13All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 365

References

16 links

github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963X Refsource CONFIRMARTICLEREPORTAdvisoryWEBVendor Advisory
github.com/go-git/go-git/releases/tag/v5.18.0X Refsource MISCARTICLEREPORTWEBProductRelease Notes
github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2X Refsource MISCARTICLEREPORTWEBProductRelease Notes
access.redhat.com/errata/RHSA-2026:17669Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-41506REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17669.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2468126REPORT
www.cve.org/CVERecord?id=CVE-2026-41506AdvisoryREPORT

Show all 16 references