Skip to content
Fencer Vulns
medium 4.7

CVE-2026-41506 json

go-git Credential leak via cross-host redirect in smart HTTP transport

published 2026-04-17 6 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-28596 , GHSA-3xc5-wrhm-f963 , GO-2026-5105

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Patch / fix

  • go github.com/go-git/go-git/v5 5.18.0
  • go github.com/go-git/go-git/v6 6.0.0-alpha.2
  • go-git_project go-git 5.18.0, 6.0.0-alpha.2
  • golang-github-go-git-go-git Debian 14 5.19.1-1
  • golang-github-go-git-go-git-v6 Debian 14 6.0.0~alpha4-1

debian advisories DEBIAN-CVE-2026-41506

  • trivy hummingbird 1 0.72.0-0.1.hum1
  • syft hummingbird 1 1.44.0-0.3.hum1

red hat advisories RHSA-2026:35111RHSA-2026:17669

  • alloy SLES 16.0, SLES for SAP applications 16.0 1.18.0-160000.1.1
  • alloy SLE Module for Basesystem 15 SP7 1.18.0-150700.15.26.1
  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1
  • terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
  • terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
  • terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
  • terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
  • terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1

suse advisories SUSE-SU-2026:23853-1SUSE-SU-2026:23865-1SUSE-SU-2026:4210-1SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1SUSE-SU-2026:3056-1

  • alloy openSUSE Leap 16.0 1.18.0-160000.1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1
  • alloy openSUSE Tumbleweed 1.18.0-1.1
  • google-osconfig-agent openSUSE Leap 16.0 20260615.01-160000.1.2
  • amazon-ssm-agent openSUSE Leap 16.0 3.3.4624.0-160000.1.1
  • cheat openSUSE Tumbleweed 5.1.0-2.1
  • trivy openSUSE Tumbleweed 0.70.0-2.1
  • git-bug openSUSE Tumbleweed 0.10.1-4.1

opensuse advisories openSUSE-SU-2026:21899-1openSUSE-SU-2026:21551-1openSUSE-SU-2026:11438-1openSUSE-SU-2026:21210-1openSUSE-SU-2026:21079-1openSUSE-SU-2026:10967-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41506 updated cvss 6.5

golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, openshift-builds/openshift-builds-image-processing-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-must-gather-rhel9 Red Hat Exploit Intelligence exploit-intelligence-tech-preview/agent-client-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-must-gather-rhel9
    +33 more products
    Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-log-reader-rhel8, rhmtc/openshift-migration-must-gather-rhel8 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-must-gather-rhel8, migration-toolkit-virtualization/mtv-must-gather-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/must-gather-rhel9, multicluster-engine/cluster-image-set-controller-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-mustgather-rhel9 Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-resolvers-rhel8 Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/serverless-must-gather-rhel9, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-must-gather-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-must-gather-rhel9, rhacm2/submariner-rhel9-operator, rhacm2/submariner-operator-bundle, rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-slim-rhel8 Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/aap-must-gather-rhel8, ansible-automation-platform-25/aap-must-gather-rhel8, ansible-automation-platform-26/aap-must-gather-rhel9 Red Hat Build of Kueue kueue/kueue-must-gather-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Edge Manager 1 flightctl, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-must-gather-rhel9, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, +18 more Red Hat OpenShift Container Platform 4 cri-o, openshift, openshift-clients, openshift-kubelet, openshift3/ose-cli, openshift-hyperkube, +51 more Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-operator-bundle, devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/gitops-rhel9, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/must-gather-rhel9, +6 more Red Hat OpenShift Virtualization 4 container-native-virtualization/kubemacpool-rhel9, container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/ovs-cni-plugin-rhel9, container-native-virtualization/cnv-must-gather-rhel8, container-native-virtualization/cnv-must-gather-rhel9, container-native-virtualization/kubesecondarydns-rhel9, +7 more Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-operator, rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-operator, rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/gitsign-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images syft 1.44.0-0.3.hum1, trivy 0.72.0-0.1.hum1
    fixed: vendor fix RHSA-2026:17669

1 more fixed, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
GitHub 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/go-git/go-git/v5
<5.18.0
5.18.0
go github.com/go-git/go-git/v6
<6.0.0-alpha.2
6.0.0-alpha.2

Affected products

  • go-git go-git

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.