Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by HashiCorp

CVE-2026-4660Go-getter may allow to arbitrary filesystem reads through git operations

High 7.5

In plain English

A high-severity information exposure in Tooling from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-hashicorp-go-getterno fix listedDEBIAN-CVE-2026-4660
Debian:14golang-github-hashicorp-go-getter1.8.9-1DEBIAN-CVE-2026-4660
Gogithub.com/hashicorp/go-getter1.8.6GO-2026-5058
Gogithub.com/hashicorp/go-getter1.8.6GHSA-92mm-2pjq-r785
Ubuntu:22.04:LTSgolang-github-hashicorp-go-getterno fix listedUBUNTU-CVE-2026-4660
Ubuntu:24.04:LTSgolang-github-hashicorp-go-getterno fix listedUBUNTU-CVE-2026-4660
Ubuntu:25.10golang-github-hashicorp-go-getterno fix listedUBUNTU-CVE-2026-4660

Affected products (as reported)

VendorProductVersions
HashiCorp Tooling 0 – before 1.8.6

Weakness: CWE-200, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References