--- id: CVE-2026-41506 title: >- golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects (CVE-2026-41506) summary: >- A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-H… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: CWE-601 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - builds_for_red_hat_openshift - confidential_compute_attestation - exploit_intelligence - external_secrets_operator_for_red_hat_openshift - kernel_module_management_operator_for_red_hat_openshift - logging_subsystem_for_red_hat_openshift - logical_volume_manager_storage - machine_deletion_remediation_operator - migration_toolkit_for_containers - migration_toolkit_for_virtualization - multicluster_engine_for_kubernetes - node_healthcheck_operator - openshift_api_for_data_protection - openshift_developer_tools_and_services - openshift_pipelines - openshift_serverless - openshift_service_mesh 2 - openshift_service_mesh 3 - pen_drive_powered_by_red_hat_lightspeed - power_monitoring_for_red_hat_openshift - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ai_inference_server - ansible_automation_platform 2 - build_of_kueue - ceph_storage 9 - edge_manager 1 - enterprise_linux 8 - enterprise_linux 9 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_dev_workspaces_operator - openshift_gitops - openshift_virtualization 4 - openstack_platform 16.2 - openstack_platform 17.1 - openstack_platform 18.0 - trusted_artifact_signer - hardened_images patched: - hardened_images - openshift_data_foundation 4.22 published: '2026-05-08' updated: '2026-10-09' sourceUpdated: '2026-10-09T16:38:36+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41506.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41506.json - url: 'https://access.redhat.com/security/cve/CVE-2026-41506' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2468126' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-41506' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41506' - url: 'https://github.com/go-git/go-git/releases/tag/v5.18.0' - url: 'https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2' - url: 'https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963' - url: 'https://access.redhat.com/errata/RHSA-2026:17669' - url: 'https://access.redhat.com/errata/RHSA-2026:35111' - url: 'https://access.redhat.com/errata/RHSA-2026:37387' - url: 'https://github.com/go-git/go-git' tags: - csaf - vex - red-hat - osv - go epss: 0.00259 epssPercentile: 0.17479 aliases: - GHSA-3xc5-wrhm-f963 - GO-2026-5105 ecosystem: go scores: vendor: 6.5 osv: 4.7 ingestedAt: '2026-07-25T19:08:11.018Z' --- ## Overview A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-HTTP clone and fetch operations, leading to the unintended disclosure of user credentials. ## Vendor advisories - **RHSA-2026:17669** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:17669) - **RHSA-2026:35111** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:35111) - **RHSA-2026:37387** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37387) - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Confidential Compute Attestation, Exploit Intelligence, External Secrets Operator for Red Hat OpenShift, Kernel Module Management Operator for Red Hat Openshift, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Confidential Compute Attestation, Exploit Intelligence, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41506.json) **golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects** — rated Moderate by Red Hat. Released 2026-05-08, updated 2026-10-09. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - Confidential Compute Attestation - Exploit Intelligence - External Secrets Operator for Red Hat OpenShift - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Machine Deletion Remediation Operator - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multicluster Engine for Kubernetes - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Pen Drive Powered by Red Hat Lightspeed - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Ceph Storage 9 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift GitOps - Red Hat OpenShift Virtualization 4 - Red Hat OpenStack Platform 16.2 - Red Hat OpenStack Platform 17.1 - Red Hat OpenStack Platform 18.0 - Red Hat Trusted Artifact Signer Fixed: - Red Hat Hardened Images - Red Hat Openshift Data Foundation 4.22 No fix planned: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - Confidential Compute Attestation - Exploit Intelligence - External Secrets Operator for Red Hat OpenShift - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Machine Deletion Remediation Operator - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multicluster Engine for Kubernetes - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Pen Drive Powered by Red Hat Lightspeed - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Ceph Storage 9 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift GitOps - Red Hat OpenShift Virtualization 4 - Red Hat OpenStack Platform 16.2 - Red Hat OpenStack Platform 17.1 - Red Hat OpenStack Platform 18.0 - Red Hat Trusted Artifact Signer Not affected: - Red Hat Openshift Data Foundation 4.22 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:17669 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:35111 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf https://access.redhat.com/errata/RHSA-2026:37387 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-41506) Affected packages: - `github.com/go-git/go-git/v5 < 5.18.0` - `github.com/go-git/go-git/v6 < 6.0.0-alpha.2` Patched in: - `github.com/go-git/go-git/v5 5.18.0` - `github.com/go-git/go-git/v6 6.0.0-alpha.2` Source: https://osv.dev/vulnerability/GHSA-3xc5-wrhm-f963