7.5
High
CVE-2026-4660 HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git…
Description
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tooling 1.8 | earliest → < 1.8.6 | 1.8.6 |
| Red Hat Trusted Artifact Signer 1.3 1780399582 | earliest → < 1780399582 | 1780399582 |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published |
Other CVEs of Tooling
The 13 CVEs of Tooling →
CVE-2026-110720
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…
9.9
Critical
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow…
7.7
High
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…
9.6
Critical
CVE-2026-16326
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
10.0
Critical