CVE-2026-71556: go-git: Worktree operations may follow symlinks

Awaiting analysis

AliasesRHSA-2026:60646RHSA-2026:60793UBUNTU-CVE-2026-71556+525 more

Published 07-08-2026Last modified 07-08-2026

Vulnerability summary

CVE-2026-71556 is a high (CVSS 7.1) vulnerability in go-git. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.36%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 13

OPENSUSE-SU-2026:11694-1 OPENSUSE-SU-2026:11803-1 OPENSUSE-SU-2026:21761-1 OPENSUSE-SU-2026:21884-1 OPENSUSE-SU-2026:22032-1 RHSA-2026:50953+12 more

Timeline

07-08-2026
PublishedVulnerability first disclosed.
07-08-2026
Last modifiedVulnerability information updated.

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

CVSS metrics

8 scores · 8 sources · 1 version

v3.17.1

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-59Improper Link Resolution Before File AccessThe product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

act< 0.2.89-r5
amazon-ssm-agent< 3.3.4851.0-r2
amazon-ssm-agent-ecs-exec< 3.3.4851.0-r2
amazon-ssm-agent-ecs-exec-fips< 3.3.4851.0-r2
amazon-ssm-agent-fips< 3.3.4851.0-r2

argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r19
argo-cd-3.2-compat< 3.2.12-r19
argo-cd-3.3< 3.3.14-r1
argo-cd-3.3-compat< 3.3.14-r9 | < 3.3.14-r1 | All versions (No fix recorded)
argo-cd-3.4< 3.4.7-r1
argo-cd-3.4-compat< 3.4.7-r1
argo-cd-3.5< 3.5.1-r1
argo-cd-3.5-compat< 3.5.1-r1
argo-cd-fips-3.1All versions (No fix recorded)
argo-cd-fips-3.1-compatAll versions (No fix recorded)
argo-cd-fips-3.2All versions (No fix recorded)
argo-cd-fips-3.2-compatAll versions (No fix recorded)
argo-cd-fips-3.3< 3.3.14-r1
argo-cd-fips-3.3-compat< 3.3.14-r1
argo-cd-fips-3.4< 3.4.7-r1
argo-cd-fips-3.4-compat< 3.4.7-r1
argo-cd-fips-3.5< 3.5.1-r1
argo-cd-fips-3.5-compat< 3.5.1-r1
argo-events< 1.9.11-r2
argo-events-fips< 1.9.11-r4
argo-workflow-executor-3.7< 3.7.17-r2
argo-workflow-executor-4.0< 4.0.8-r3
argo-workflow-executor-fips-3.7< 3.7.17-r1
argo-workflow-executor-fips-4.0< 4.0.8-r3
argo-workflows-3.7< 3.7.17-r2
argo-workflows-4.0< 4.0.8-r3
argo-workflows-fips-3.7< 3.7.17-r1
argo-workflows-fips-4.0< 4.0.8-r3
argo-workflows-ui-4.0< 4.0.11-r0
argocd-image-updater< 1.2.2-r7
argocd-image-updater-fips< 1.2.2-r9
bom< 0.7.1-r24
boring-registry< 0.19.0-r1
boring-registry-fips< 0.19.0-r1
cerbosAll versions (No fix recorded) | < 0.54.0-r2
cerbos-fips< 0.54.0-r2
cerbosctl< 0.54.0-r2
cerbosctl-fips< 0.54.0-r2
chainloop-cli< 1.105.8-r1
chainloop-cli-fips< 1.105.8-r0
cloudbeat-8.17< 8.17.10-r34
cloudbeat-8.19< 8.19.19-r2
cloudbeat-9.2< 9.2.8-r17
cloudbeat-9.3< 9.3.8-r3
cloudbeat-9.4< 9.4.4-r4
cloudbeat-9.5< 9.5.0-r1
cloudbeat-fips-8.17< 8.17.10-r40
cloudbeat-fips-8.19< 8.19.19-r2
cloudbeat-fips-9.2< 9.2.8-r16
cloudbeat-fips-9.3< 9.3.8-r3
cloudbeat-fips-9.4< 9.4.4-r3
cloudbeat-fips-9.5< 9.5.0-r1
coder-2.29< 2.29.19-r4
coder-2.32< 2.32.10-r4
coder-2.33< 2.33.11-r6
coder-2.34< 2.34.7-r3
coder-fips-2.29< 2.29.19-r4
coder-fips-2.32< 2.32.10-r3
coder-fips-2.33< 2.33.11-r6
coder-fips-2.34< 2.34.7-r1
commercial-chainloop-cliAll versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
crossplane-1.20-crank< 1.20.11-r2
crossplane-2.0-crank< 2.0.8-r18
crossplane-2.1-crank< 2.1.8-r3
crossplane-2.2-crank< 2.2.4-r3
crossplane-2.3-crank< 2.3.4-r4
crossplane-fips-1.20-crank< 1.20.11-r3
crossplane-fips-2.0-crank< 2.0.8-r19
crossplane-fips-2.1-crank< 2.1.8-r4
crossplane-fips-2.2-crank< 2.2.4-r4
crossplane-fips-2.3-crank< 2.3.4-r4
dagger< 0.20.8-r15
external-secrets-operator-2.0< 2.0.1-r12
external-secrets-operator-2.1< 2.1.0-r12
external-secrets-operator-2.2< 2.2.0-r22
external-secrets-operator-2.3< 2.3.0-r18
external-secrets-operator-2.4< 2.4.1-r16
external-secrets-operator-2.5< 2.5.0-r13
external-secrets-operator-2.6< 2.6.0-r9
external-secrets-operator-fips-2.0< 2.0.1-r12
external-secrets-operator-fips-2.1< 2.1.0-r11
external-secrets-operator-fips-2.2< 2.2.0-r25
external-secrets-operator-fips-2.3< 2.3.0-r19
external-secrets-operator-fips-2.4< 2.4.1-r16
external-secrets-operator-fips-2.5< 2.5.0-r16
external-secrets-operator-fips-2.6< 2.6.0-r10
flux-2.5< 2.5.1-r26
flux-2.6< 2.6.4-r31
flux-2.7< 2.7.5-r31
flux-2.8< 2.8.8-r15
flux-2.9< 2.9.4-r1
flux-fips-2.5< 2.5.1-r24
flux-fips-2.6< 2.6.4-r32
flux-fips-2.7< 2.7.5-r28
flux-fips-2.8< 2.8.8-r11
flux-fips-2.9< 2.9.4-r1
flux-image-automation-controller< 1.2.4-r1
flux-image-automation-controller-fips< 1.2.4-r1
flux-notification-controller< 1.9.3-r1
flux-notification-controller-fips< 1.9.3-r1
flux-operator< 0.58.0-r2
flux-operator-fips< 0.58.0-r1
flux-source-controller< 1.9.4-r0
flux-source-controller-fips< 1.9.4-r1
gitaly-19.0< 19.0.5-r1
gitaly-19.1< 19.1.3-r2
gitaly-19.2< 19.2.1-r1
gitaly-compat-19.1< 19.1.8-r0
gitaly-fips-19.0< 19.0.5-r2
gitaly-fips-19.1< 19.1.3-r1
gitaly-fips-19.2< 19.2.1-r1
gitea< 1.27.1-r1
gitea-fips< 1.27.1-r1
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0< 19.0.6-r1
gitlab-rails-ce-19.1< 19.1.3-r8
gitlab-rails-ce-19.2< 19.2.2-r1
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0< 19.0.5-r4
gitlab-rails-ce-fips-19.1< 19.1.6-r0
gitlab-rails-ce-fips-19.2< 19.2.1-r3
gitlab-runner-18.11All versions (No fix recorded)
gitlab-runner-19.0< 19.0.3-r1
gitlab-runner-19.1< 19.1.2-r2
gitlab-runner-19.2< 19.2.1-r1
gitlab-runner-fips-18.11All versions (No fix recorded)
gitlab-runner-fips-19.0< 19.0.3-r1
gitlab-runner-fips-19.1< 19.1.2-r1
gitlab-runner-fips-19.2< 19.2.1-r1
gitlab-runner-helper-18.11All versions (No fix recorded)
gitlab-runner-helper-19.0< 19.0.3-r1
gitlab-runner-helper-19.1< 19.1.2-r2 | All versions (No fix recorded)
gitlab-runner-helper-19.2< 19.2.1-r1
gitlab-runner-helper-fips-18.11All versions (No fix recorded)
gitlab-runner-helper-fips-19.0< 19.0.3-r1
gitlab-runner-helper-fips-19.1< 19.1.2-r1
gitlab-runner-helper-fips-19.2< 19.2.1-r1
gitsign< 0.17.1-r1
gomplate-4< 4.3.3-r22
gomplate-5< 5.2.0-r2
gomplate-fips-4< 4.3.3-r23
gomplate-fips-5< 5.2.0-r2
google-osconfig-agent< 20251028.00-r28
goreleaser< 2.17.1-r2
gptscript< 0.9.9-r441
grafana-12.1< 12.1.10.01-r16
grafana-alloy< 1.18.0-r5
grafana-alloy-fips< 1.18.1-r1
grafana-fips-12.1< 12.1.10.01-r6
grype< 0.116.1-r1
grype-db< 0.54.3-r2
grype-fips< 0.116.1-r1
guac< 1.1.0-r25
guacingest< 1.1.0-r25
guacone< 1.1.0-r25
jfrog-cli< 2.117.0-r2
k9s< 0.51.0-r9
k9s-fips< 0.51.0-r12
kaniko< 1.25.17-r1
kaniko-fips< 1.25.17-r1
kargo-1.10< 1.10.9-r3
kargo-1.8< 1.8.14-r2
kargo-1.9< 1.9.10-r2
kots< 1.131.1-r2
kubescape< 4.0.11-r5
kubescape-server< 4.0.11-r5
kubescape-server-downloader< 4.0.11-r5
kubescape-server-fips< 4.0.11-r4
kubescape-server-fips-downloader< 4.0.11-r4
kubevela-vela-cli< 1.11.0-r4
kubevela-vela-cli-fips< 1.11.0-r5
kubevela-vela-core< 1.11.0-r4
kubevela-vela-core-fips< 1.11.0-r5
kyverno-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-cli-1.15< 1.15.3-r28
kyverno-cli-1.16< 1.16.4-r23
kyverno-cli-1.17< 1.17.2-r27 | < 1.17.2-r35
kyverno-cli-1.18< 1.18.2-r6
kyverno-cli-fips-1.15< 1.15.20-r16
kyverno-cli-fips-1.16< 1.16.4-r21

Show all 200

1 vendor · 200 products · Showing 200 of 355

References

19 links

github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxmX Refsource CONFIRMARTICLEREPORTAdvisoryWEB
github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aabX Refsource MISCARTICLEREPORTFIXWEB
github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07acX Refsource MISCARTICLEREPORTFIXWEB
github.com/go-git/go-git/releases/tag/v5.19.2X Refsource MISCARTICLEREPORTWEB
github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5X Refsource MISCARTICLEREPORTWEB
access.redhat.com/errata/RHSA-2026:60646Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-71556REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60646.jsonAdvisory

Show all 19 references

bugzilla.redhat.com/show_bug.cgi?id=2512562REPORT
www.cve.org/CVERecord?id=CVE-2026-71556AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-71556AdvisoryOval
access.redhat.com/errata/RHSA-2026:60793Advisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60793.jsonAdvisory
ubuntu.com/security/CVE-2026-71556REPORT
security-tracker.debian.org/tracker/CVE-2026-71556Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71556.jsonAdvisory
github.com/go-git/go-gitPACKAGE