EUVD-2026-20894
GHSA-92mm-2pjq-r785
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious git URL with path traversal
-
ExploitPass URL to go-getter library ≤v1.8.5
-
ExecutionLibrary processes URL during git operation
-
ImpactRead arbitrary files from filesystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires go-getter library versions up to v1.8.5 processing a maliciously crafted URL during git operations. Remote unauthenticated attacker can exploit this by providing the malicious URL to an application using vulnerable go-getter. go-getter/v2 is not affected. |
| Impact | High-severity information disclosure affecting unauthenticated remote attackers via malicious git URLs. CVSS 7.5 reflects high confidentiality impact with network attack vector and low complexity. Blast radius depends on go-getter v1.8.5 deployment in downstream tools; HashiCorp products and third-party integrations querying untrusted repositories face exposure. Immediate patching to v1.8.6 required. |
| Exploit ScenarioDerived | Attacker crafts malicious git URL containing path traversal sequences, sent to vulnerable go-getter instance. During git operation parsing, library reads arbitrary filesystem files instead of repository contents, exfiltrating sensitive data. No authentication required; exploitation requires victim processing attacker-controlled URL. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote attackers to access sensitive files from the target filesystem through specially crafted git operation URLs. The vulnerability permits confidentiality breach without authentication requirements, affecting network-accessible services utilizing the library for repository cloning or fetching operations. Fixed in version 1.8.6; go-getter/v2 branch unaffected. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade go-getter library to version 1.8.6 or later immediately. Update Go module dependencies via 'go get -u github.com/hashicorp/go-getter@v1.8.6' and verify go.mod reflects patched version. For applications unable to upgrade immediately, migrate to go-getter/v2 branch which is not affected by this vulnerability. Organizations should audit all projects for go-getter dependencies and prioritize updates for internet-facing services. Detailed vendor security bulletin available at https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311. No effective workaround exists for v1 branch without upgrading; restrict network access to services using vulnerable versions until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Path traversal flaw (CWE-200) in git URL processing logic permits file system access beyond intended repository boundaries. Malicious URL parameters during git clone/fetch operations bypass input sanitization, enabling read access to arbitrary files accessible to the application process. Root cause stems from insufficient validation of user-supplied git references before filesystem operations.
Know when Tooling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
2DescriptionCVE.org
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Executive ViewAI
HashiCorp go-getter library versions through 1.8.5 contain an arbitrary file read vulnerability that allows unauthenticated attackers to access sensitive files on systems using the library for git operations, potentially exposing credentials, configuration, and proprietary data without authentication. Organizations running Terraform, Consul, Nomad, or other HashiCorp products that depend on this library face immediate risk of unauthorized data exfiltration if exposed to untrusted network inputs. Affected deployments require urgent assessment and remediation due to the high severity and ease of exploitation.
Vendor-released patch: version 1.8.6 or go-getter/v2 branch. If immediate patching is unavailable, implement network segmentation to restrict go-getter services from receiving untrusted URLs, disable git operations where operationally feasible, enforce strict file permissions to minimize sensitive file accessibility, and conduct enhanced log monitoring for unusual file access patterns on affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on beha
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication
Cross-namespace authorization bypass in HashiCorp consul-k8s 0.42.0 and later can let an attacker with an existing low-p
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes te
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains ano
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to re
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the se
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to impr
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB