What is the CVSS score of CVE-2026-4660?

CVE-2026-4660 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Tooling are affected by CVE-2026-4660?

HashiCorp go-getter library versions through 1.8.5 contain an arbitrary file read vulnerability that allows unauthenticated attackers to access sensitive files on systems using the library for git…. A patch is available.

How to fix or mitigate CVE-2026-4660?

Within 24 hours: Identify all systems running HashiCorp go-getter v1.8.5 and earlier by auditing dependency manifests in Terraform configurations, HashiCorp product installations, and custom applications using the library; disable or restrict network access to affected services pending patch deployment. Within 7 days: Apply vendor-released patch version 1.8.6 or upgrade to go-getter/v2 branch; validate patching across all production and staging environments. Within 30 days: Conduct forensic review of git operation logs on affected systems to determine exposure window; assume potential compromise of files accessible to the service account running go-getter operations and rotate any exposed credentials.

Tooling CVE-2026-4660

EUVD-2026-20894 HIGH

Information Exposure (CWE-200)

2026-04-09 HashiCorp

GHSA-92mm-2pjq-r785

Information Disclosure Hashicorp Tooling

7.5

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 14:15 euvd

EUVD-2026-20894

Analysis Generated

Apr 09, 2026 - 14:15 vuln.today

CVE Published

Apr 09, 2026 - 13:47 nvd

HIGH 7.5

DescriptionCVE.org

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

AnalysisAI

Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote attackers to access sensitive files from the target filesystem through specially crafted git operation URLs. The vulnerability permits confidentiality breach without authentication requirements, affecting network-accessible services utilizing the library for repository cloning or fetching operations. Fixed in version 1.8.6; go-getter/v2 branch unaffected. No public exploit identified at time of analysis.

Technical ContextAI

Path traversal flaw (CWE-200) in git URL processing logic permits file system access beyond intended repository boundaries. Malicious URL parameters during git clone/fetch operations bypass input sanitization, enabling read access to arbitrary files accessible to the application process. Root cause stems from insufficient validation of user-supplied git references before filesystem operations.

RemediationAI

Vendor-released patch: upgrade go-getter library to version 1.8.6 or later immediately. Update Go module dependencies via 'go get -u github.com/hashicorp/go-getter@v1.8.6' and verify go.mod reflects patched version. For applications unable to upgrade immediately, migrate to go-getter/v2 branch which is not affected by this vulnerability. Organizations should audit all projects for go-getter dependencies and prioritize updates for internet-facing services. Detailed vendor security bulletin available at https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311. No effective workaround exists for v1 branch without upgrading; restrict network access to services using vulnerable versions until patched.

More in Tooling

View all

CVE-2026-5061 MEDIUM This Month

4.7 May 12

Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended

Same weakness CWE-200 – Information Exposure

View all

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

CVE-2016-2388 MEDIUM POC

5.3

CVE-2016-1561 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP5	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Affected
openSUSE Leap 15.5	Affected
openSUSE Leap 15.6	Affected

CVE-2026-4660 vulnerability details – vuln.today

Back

Tooling CVE-2026-4660

Severity by source

CVSS VectorVendor: HashiCorp

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Tooling

Same weakness CWE-200 – Information Exposure

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code