CVE-2026-32282 json
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
published 2026-04-07 7 mo ago modified 2026-09-29 40 d ago also BIT-golang-2026-32282 , EUVD-2026-20012 , GO-2026-4864
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
Patch / fix
- bitnami golang 1.25.9, 1.26.2
- go stdlib 1.25.9, 1.26.2
- Go standard library internal/syscall/unix 1.25.9, 1.26.2
- golang-1.26 Debian 14 1.26.2-1
debian advisories DEBIAN-CVE-2026-32282
- etcd openstack 17.1 3.4.26-9.6.el9ost
- erlang openstack 17.1 24.3.4.2-7.el9ost
- erlang-ssl openstack 17.1 24.3.4.2-7.el9ost
- erlang-asn1 openstack 17.1 24.3.4.2-7.el9ost
- erlang-erts openstack 17.1 24.3.4.2-7.el9ost
- erlang-sasl openstack 17.1 24.3.4.2-7.el9ost
- erlang-snmp openstack 17.1 24.3.4.2-7.el9ost
- erlang-eldap openstack 17.1 24.3.4.2-7.el9ost
red hat advisories RHSA-2026:72805RHSA-2026:72737RHSA-2026:72276RHSA-2026:69235RHSA-2026:68504RHSA-2026:67319
- go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.12-160000.1.1
- go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.4-160000.1.1
- go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.9-150000.1.21.1
- go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.2-150000.1.6.1
- go1.25 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.25.9-150000.1.35.1
- go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.2-150000.1.9.1
suse advisories SUSE-SU-2026:22638-1SUSE-SU-2026:22572-1SUSE-SU-2026:1581-1SUSE-SU-2026:1580-1SUSE-SU-2026:1321-1SUSE-SU-2026:1320-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- go1.25-openssl openSUSE Leap 16.0 1.25.12-160000.1.1
- go1.26-openssl openSUSE Leap 16.0 1.26.4-160000.1.1
- coredns openSUSE Tumbleweed 1.14.3-1.1
- go1.26 openSUSE Leap 16.0 1.26.2-160000.1.1
- go1.25 openSUSE Leap 16.0 1.25.9-160000.1.1
- go1.26 openSUSE Tumbleweed 1.26.2-1.1
- go1.25 openSUSE Tumbleweed 1.25.9-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21319-1openSUSE-SU-2026:21254-1openSUSE-SU-2026:10673-1openSUSE-SU-2026:20571-1openSUSE-SU-2026:20570-1
- osbuild-composer AlmaLinux 8 101.5-1.el8_10.alma.1
- osbuild-composer-core AlmaLinux 8 101.5-1.el8_10.alma.1
- osbuild-composer-worker AlmaLinux 8 101.5-1.el8_10.alma.1
- yggdrasil-worker-package-manager AlmaLinux 10 0.2.3-7.el10_2
- go-fdo-client AlmaLinux 10 1.0.0-4.el10_2
- go-fdo-server AlmaLinux 10 1.0.1-2.el10_2
- go-fdo-server-owner AlmaLinux 10 1.0.1-2.el10_2
- go-fdo-server-rendezvous AlmaLinux 10 1.0.1-2.el10_2
almalinux advisories ALSA-2026:48790ALSA-2026:25999ALSA-2026:22141ALSA-2026:19133ALSA-2026:19134ALSA-2026:19135
- osbuild-composer Rocky Linux 8 101.5-1.el8_10.rocky.0.6
- yggdrasil-worker-package-manager Rocky Linux 10 0.2.3-7.el10_2
- yggdrasil Rocky Linux 10 0.4.9-5.el10_2
- osbuild-composer Rocky Linux 9 165.1-2.el9_8.rocky.0.1
- go-fdo-client Rocky Linux 10 1.0.0-4.el10_2
- go-fdo-server Rocky Linux 10 1.0.1-2.el10_2
- osbuild-composer Rocky Linux 10 165.1-2.el10_2.rocky.0.1
- image-builder Rocky Linux 10 52.1-1.el10_2.rocky.0.1
rocky linux advisories RLSA-2026:48790RLSA-2026:25999RLSA-2026:24716RLSA-2026:22714RLSA-2026:22141RLSA-2026:22450
- go Alpine 3.23 1.25.9-r0
- go Alpine 3.24 1.26.2-r0
- rclone Alpine 3.24 1.73.5-r0
alpine advisories ALPINE-CVE-2026-32282
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go.dev/cl/763761 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-32282 updated cvss 7.8
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 redhat-user-workloads/appliance Red Hat cert-manager Operator for Red Hat OpenShift redhat-user-workloads/jetstack-cert-manager-1-17, redhat-user-workloads/jetstack-cert-manager-1-18 Red Hat Compliance Operator redhat-user-workloads/ocp-isc-tenant/compliance-operator-bundle-releaseaffected: workaround, no fix available
-
Red Hat Confidential Compute Attestation redhat-user-workloads/trustee-operator, redhat-user-workloads/ose-osc-tenant/osc-caaaffected: workaround, no fix planned “Will not fix”
-
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/keda-adapter Red Hat Deployment Validation Operator redhat-user-workloads/deployment-validation-operator Red Hat ExternalDNS Operator edo/external-dns-rhel8 Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel8-operator Red Hat File Integrity Operator redhat-user-workloads/ocp-isc-tenant/file-integrity-operator-releaseaffected: workaround, no fix available
-
Red Hat Gatekeeper 3 redhat-user-workloads/gatekeeper-operator-3-18, redhat-user-workloads/gatekeeper-operator-3-20affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Logging Subsystem for Red Hat OpenShift redhat-user-workloads/ocp-art-tenant/art-images, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-0, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-2, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-4 Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel8 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel8-operatoraffected: workaround, no fix available
-
Red Hat Migration Toolkit for Applications 8 redhat-user-workloads/ocp-art-tenant/art-imagesaffected: workaround, no fix planned “Will not fix”
-
Red Hat Migration Toolkit for Containers redhat-user-workloads/ocp-art-tenant/art-imagesaffected: workaround, no fix available
-
Red Hat mirror registry for Red Hat OpenShift openshift/mirror-registry-rhel8affected: workaround, no fix planned “Out of support scope”
show 7 moreshow fewer
-
Red Hat mirror registry for Red Hat OpenShift 2 redhat-user-workloads/quay-eng-tenant/mirror-registry-v2-0 Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-28, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-29, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-210, redhat-user-workloads/crt-redhat-acm-tenant/kube-rbac-proxy-mce-211, redhat-user-workloads/crt-redhat-acm-tenant/image-based-install-operator-mce-26, redhat-user-workloads/crt-redhat-acm-tenant/image-based-install-operator-mce-27 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8 Red Hat Network Observability Operator redhat-user-workloads/ocp-network-observab-tenant/flowlogs-pipeline-zstream Red Hat OpenShift API for Data Protection redhat-user-workloads/ocp-art-tenant/art-imagesaffected: workaround, no fix available
+4 more productsfewer
Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Lightspeed redhat-user-workloads/crt-nshift-lightspeed-tenant/openshift-mcp-server Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-clients, redhat-user-workloads/kn-plugin-event-sender -
Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operatoraffected: workaround, no fix planned “Will not fix”
-
Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/volsync-tenant/volsync-0-13, redhat-user-workloads/volsync-tenant/volsync-0-14, redhat-user-workloads/volsync-tenant/volsync-0-15affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Advanced Cluster Security 4 rhacs-eng/release-main Red Hat AMQ Broker 7 amq7/amq-broker-rhel9-operator Red Hat Ansible Automation Platform 2 redhat-user-workloads/ansible-sre-tenant/aoc-azure-aap-installer-container Red Hat build of Apache Camel - HawtIO 4 rhbac-4/hawtio-rhel8-operator, rhbac-4/hawtio-rhel9-operatoraffected: workaround, no fix available
-
Red Hat build of Apicurio Registry 2 apicurio/apicurio-registry-rhel8-operator, apicurio/apicurio-registry-rhel9-operatoraffected: workaround, no fix planned “Will not fix”
-
Red Hat Ceph Storage 5 rhceph-ci/grafana Red Hat Ceph Storage 6 rhceph-ci/grafanaaffected: workaround, no fix available “Fix deferred”
-
Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Connectivity Link 1 redhat-user-workloads/api-management-tenant/rhcl-1-3-coredns Red Hat Edge Manager 1 redhat-user-workloads/flightctl-ui Red Hat Enterprise Linux 7 rhc Red Hat Enterprise Linux 8 golang, podman, skopeo, buildah, go-toolset, golang-bin, +15 moreaffected: workaround, no fix available
25 more affected, 86 more fixed, 84 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
| go | stdlib | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
Affected products
- Go standard library internal/syscall/unix
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
go.dev
/cl/763761
patch
-
pkg.go.dev
/vuln/GO-2026-4864
vendor-advisory, advisory
-
go.dev
/issue/78293
issue-tracking, report
-
groups.google.com
/g/golang-announce/c/0uYbvbPZRWU
mailing-list, release-notes, discussion, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32282
web
Sources
- CVE List CVE-2026-32282
- NVD CVE-2026-32282
- OSV BIT-golang-2026-32282
- OSV GO-2026-4864
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.