Skip to main content

Red Hat CVE-2026-88922

| EUVDEUVD-2026-79245 MEDIUM
Improper Preservation of Permissions (CWE-281)
2026-09-15 security@hashicorp.com GHSA-34p9-pr49-jvvc
Privilege Escalation Red Hat Suse
6.7
CVSS 3.1 · Vendor: hashicorp
View

Vulnerability Assessment

Weakness
CWE
CWE-281
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Permission preservation
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.

Affected VersionsENISA

Shared library 1.0.1 <2.2.4

Affected Packages

euvd shared_library fix: 2.2.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hashicorp) PRIMARY 6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
SUSE MEDIUM
Red Hat 6.7 MEDIUM

Primary rating from Vendor (hashicorp).

CVSS VectorVendor: hashicorp

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Patch available
Sep 15, 2026 - 20:50 EUVD

DescriptionCVE.org

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Threat Intelligence Overview

EPSS Score
0.1%
Top 100% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-281 – Improper Preservation of Permissions

View all
CVE-2017-8543 CRITICAL
9.8
CVE-2024-46310 CRITICAL POC
9.1
CVE-2017-8589 CRITICAL
9.8
CVE-2024-54879 CRITICAL POC
9.1
CVE-2024-41650 CRITICAL POC
9.8
CVE-2024-41649 CRITICAL POC
9.8
CVE-2024-41648 CRITICAL POC
9.8
CVE-2024-41646 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:68251 ADVISORY https://access.redhat.com/errata/RHSA-2026:68255 ADVISORY https://access.redhat.com/errata/RHSA-2026:68259 ADVISORY https://access.redhat.com/errata/RHSA-2026:68261 ADVISORY https://access.redhat.com/errata/RHSA-2026:68281 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-88922 ADVISORY https://vuldb.com/vuln/404673 REF https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy