CVE-2026-4660: hashicorp tooling
CVSS: 7.5v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-4660DEBIAN-CVE-2026-4660CGA-27cr-hfpf-p3wwCGA-2822-cc4x-8rxfCGA-2vqh-r2q7-mvjhCGA-2wff-45ww-4qr6CGA-3jvh-8gf5-whx5CGA-4474-hmj2-5qpcCGA-4722-pr47-pmfjCGA-4grh-mxpm-438wCGA-5vr9-3r8v-978jCGA-6m7p-7wm5-h79cCGA-6rmw-wfhv-87w5CGA-724g-mx48-hh9vCGA-7c6g-3p6h-45mvCGA-7qph-c62g-5996CGA-838p-6jxv-73g6CGA-8g3w-mxf9-hq4pCGA-9h68-74fw-j7vvCGA-cqh4-p89q-w6fcCGA-fh4r-fm6f-47wwCGA-fvmj-96gg-4w4pCGA-fw3w-7rrr-mwv3CGA-g298-f6cw-482pCGA-g9wp-hrq3-qv9pCGA-j795-w9vm-8prhCGA-jcqg-px88-qw93CGA-jx8h-3jcf-rxpgCGA-m6fr-2jfc-p8hjCGA-mf2g-2wv3-fh3wCGA-mhxc-8gg6-x4w8CGA-p6m9-62g7-j683CGA-ph6x-54m7-m577CGA-pwfm-fvjc-gc54CGA-px57-f686-889wCGA-pxcc-hg89-28hhCGA-r562-345x-cqf5CGA-r666-qf5r-xxh3CGA-r788-qcff-qhcpCGA-rmcx-pmr7-h8qhCGA-v427-cr5f-j9r7CGA-v53v-xgxr-5q6mCGA-v8cx-5q23-vrm8CGA-vhm4-q2r5-59jqCGA-vvqj-gc79-vx39CGA-vwhr-h9f5-f8qjCGA-wpch-2rj8-7f63CGA-xg9x-2f3w-j337CGA-xjj3-3834-wmccGHSA-92mm-2pjq-r785GO-2026-5058CGA-27xw-grpq-vxfwCGA-2ppj-m69x-77fwCGA-2r7f-vjc4-qf6rCGA-348p-7p8h-wj7xCGA-3cj7-7q3h-334qCGA-3cxq-2r3r-6rjxCGA-3q2r-4rv3-gxm9CGA-3xx9-44f6-f8rmCGA-446j-5p8j-pjj8CGA-45wq-2q3r-7q7rCGA-466w-f2qm-hpw7CGA-46gj-f6fw-rm6qCGA-4cwx-2v9w-7fg7CGA-4qxv-2gg4-93crCGA-4r2g-vhf8-7h2cCGA-4r57-j6mf-vf6pCGA-4rfm-6q5q-qp2fCGA-56gh-c777-g2fjCGA-57jg-pxqx-7h3fCGA-5c2w-h22w-c696CGA-5fjg-vmr3-m495CGA-66x8-96rq-8fhgCGA-6949-c3mp-wc4mCGA-6mjc-69hw-2322CGA-6pr6-hvw2-pm34CGA-72cx-24f6-969mCGA-77mf-h4r8-x37jCGA-786j-x2xg-349pCGA-7gjr-9m6m-jhvhCGA-7p58-6p75-xpfwCGA-7v35-gpvp-37hfCGA-7v3h-4v32-f3qvCGA-7w8j-jcmp-pvr5CGA-82j9-5x88-pg4xCGA-834r-j44h-hfg7CGA-838m-7wfv-5923CGA-8486-qhq5-3mv4CGA-87rc-gq6h-h8gxCGA-89cc-p369-2cwcCGA-8g34-96hv-cf75CGA-8mc7-fmj8-g7pwCGA-8r35-h67q-8348CGA-99m5-h227-hjhqCGA-9r6r-pfqf-557gCGA-c2fh-g49g-w956CGA-c4r3-r4x9-jj84CGA-cg3h-xjfv-7wr5CGA-cw7x-h8w3-gpw5CGA-cxvv-fv77-8m34CGA-f8fv-c4v3-f67cCGA-fhq7-vh27-jxj2CGA-fpv8-jhhh-g3jqCGA-fpwx-r54m-5cxrCGA-fwjj-5jv5-38j8CGA-fx76-xwjr-m6xrCGA-ggvq-9hxv-gf4fCGA-gpg6-hfr8-pj47CGA-grh4-rvcc-p96fCGA-gwqp-qwgx-4j79CGA-gxmr-3q2h-88qpCGA-h3vv-3xqg-ccjxCGA-h8x3-9mmx-3v43CGA-hfm8-q952-8ch7CGA-hwq4-96j8-3r6hCGA-hx4w-w9w8-r5ccCGA-hxvw-j798-rrhgCGA-j573-22vj-w2qvCGA-j72c-729j-3gx3CGA-jj9g-24gq-r2gfCGA-jvx9-x262-xj93CGA-m37m-gc6f-25p2CGA-m9xv-53xx-4r4hCGA-mj2r-rw93-73q8CGA-mq39-p2w3-95m7CGA-mwxw-v3pj-qxm6CGA-mx23-2j8p-7x7jCGA-pc6q-fw47-937jCGA-pq6p-g6c5-j2p6CGA-q6fr-h225-h4q5CGA-qcm4-jj2r-23r8CGA-qg6g-xfx7-5785CGA-qj7v-7848-4r63CGA-qv62-96pv-wm2fCGA-r3gj-94wg-pj48CGA-rrfw-m43w-phq9CGA-rv69-674g-hf3fCGA-v2ww-mx98-28pmCGA-v473-j6j7-4rfqCGA-v6mj-9fhr-29mjCGA-v9ww-p2qv-39m8CGA-vp87-5h7r-52r6CGA-wg2g-w853-h5rrCGA-wgfx-pr4h-935wCGA-wjc9-f287-wp7jCGA-x434-2v6c-m78rCGA-x66m-4x5w-7chjCGA-xcjp-5v8j-w7qfCGA-xfhg-qm5j-vj6xCGA-xg9c-33p9-hhg6CGA-xrw9-5hw3-9c75CGA-xxw3-8x8h-hmvf
Published 09-04-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-4660 is a high (CVSS 7.5) vulnerability in hashicorp tooling. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.55%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 09-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
-0.04 pp
From 0.58% on 21-09-2026
21-09-202621-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Chainguard73 products
- cg< 0.2.246-r1
- chainctl< 0.2.248-r0
- chainctl-fips< 0.2.247-r0
- cloudbeat-8.17< 8.17.10-r14
- cloudbeat-8.18All versions (No fix recorded)
Wolfi22 products
- conftest< 0.68.2-r0
- grype< 0.111.0-r3
- k9s< 0.50.18-r18
- kots< 1.130.0-r4
- kubescape< 4.0.5-r0
Debian1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
Github.com/hashicorp1 product
- go-getter< 1.8.6
Hashicorp1 product
- tooling< 1.8.6
Ubuntu1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
6 vendors · 99 products
