7.5
Élevée
CVE-2026-4660 HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git…
Description
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Tooling 1.8 | premières → < 1.8.6 | 1.8.6 |
| Red Hat Trusted Artifact Signer 1.3 1780399582 | premières → < 1780399582 | 1780399582 |
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat Trusted Artifact Signer | Versions non publiées |
Références
- discuss.hashicorp.com discuss.hashicorp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Tooling
Les 13 CVE de Tooling →
CVE-2026-110720
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding…
9.9
Critique
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow…
7.7
Élevée
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in…
9.6
Critique
CVE-2026-16326
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
10.0
Critique