Vulnerability-Lookup

OPENSUSE-SU-2026:11575-1

Vulnerability from csaf_opensuse - Published: 2026-08-22 00:00 - Updated: 2026-08-22 00:00

Summary

helm-4.2.4-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: helm-4.2.4-1.1 on GA media

Description of the patch: These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11575

CVE-2026-50163

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-56864

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-56865

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64	—	Vendor Fix

Threats

Impact important

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-50163/	self
https://www.suse.com/security/cve/CVE-2026-56864/	self
https://www.suse.com/security/cve/CVE-2026-56865/	self
https://www.suse.com/security/cve/CVE-2026-50163	external
https://bugzilla.suse.com/1271462	external
https://www.suse.com/security/cve/CVE-2026-56864	external
https://bugzilla.suse.com/1275025	external
https://www.suse.com/security/cve/CVE-2026-56865	external
https://bugzilla.suse.com/1275024	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "helm-4.2.4-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11575",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11575-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50163 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50163/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56864 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56864/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56865 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56865/"
      }
    ],
    "title": "helm-4.2.4-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-08-22T00:00:00Z",
      "generator": {
        "date": "2026-08-22T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11575-1",
      "initial_release_date": "2026-08-22T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-22T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-4.2.4-1.1.aarch64",
                "product": {
                  "name": "helm-4.2.4-1.1.aarch64",
                  "product_id": "helm-4.2.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-4.2.4-1.1.aarch64",
                "product": {
                  "name": "helm-bash-completion-4.2.4-1.1.aarch64",
                  "product_id": "helm-bash-completion-4.2.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-4.2.4-1.1.aarch64",
                "product": {
                  "name": "helm-fish-completion-4.2.4-1.1.aarch64",
                  "product_id": "helm-fish-completion-4.2.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-4.2.4-1.1.aarch64",
                "product": {
                  "name": "helm-zsh-completion-4.2.4-1.1.aarch64",
                  "product_id": "helm-zsh-completion-4.2.4-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-4.2.4-1.1.ppc64le",
                "product": {
                  "name": "helm-4.2.4-1.1.ppc64le",
                  "product_id": "helm-4.2.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-4.2.4-1.1.ppc64le",
                "product": {
                  "name": "helm-bash-completion-4.2.4-1.1.ppc64le",
                  "product_id": "helm-bash-completion-4.2.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-4.2.4-1.1.ppc64le",
                "product": {
                  "name": "helm-fish-completion-4.2.4-1.1.ppc64le",
                  "product_id": "helm-fish-completion-4.2.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-4.2.4-1.1.ppc64le",
                "product": {
                  "name": "helm-zsh-completion-4.2.4-1.1.ppc64le",
                  "product_id": "helm-zsh-completion-4.2.4-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-4.2.4-1.1.s390x",
                "product": {
                  "name": "helm-4.2.4-1.1.s390x",
                  "product_id": "helm-4.2.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-4.2.4-1.1.s390x",
                "product": {
                  "name": "helm-bash-completion-4.2.4-1.1.s390x",
                  "product_id": "helm-bash-completion-4.2.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-4.2.4-1.1.s390x",
                "product": {
                  "name": "helm-fish-completion-4.2.4-1.1.s390x",
                  "product_id": "helm-fish-completion-4.2.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-4.2.4-1.1.s390x",
                "product": {
                  "name": "helm-zsh-completion-4.2.4-1.1.s390x",
                  "product_id": "helm-zsh-completion-4.2.4-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-4.2.4-1.1.x86_64",
                "product": {
                  "name": "helm-4.2.4-1.1.x86_64",
                  "product_id": "helm-4.2.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-bash-completion-4.2.4-1.1.x86_64",
                "product": {
                  "name": "helm-bash-completion-4.2.4-1.1.x86_64",
                  "product_id": "helm-bash-completion-4.2.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-4.2.4-1.1.x86_64",
                "product": {
                  "name": "helm-fish-completion-4.2.4-1.1.x86_64",
                  "product_id": "helm-fish-completion-4.2.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-4.2.4-1.1.x86_64",
                "product": {
                  "name": "helm-zsh-completion-4.2.4-1.1.x86_64",
                  "product_id": "helm-zsh-completion-4.2.4-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-4.2.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64"
        },
        "product_reference": "helm-4.2.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-4.2.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le"
        },
        "product_reference": "helm-4.2.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-4.2.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x"
        },
        "product_reference": "helm-4.2.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-4.2.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64"
        },
        "product_reference": "helm-4.2.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-4.2.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64"
        },
        "product_reference": "helm-bash-completion-4.2.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-4.2.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le"
        },
        "product_reference": "helm-bash-completion-4.2.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-4.2.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x"
        },
        "product_reference": "helm-bash-completion-4.2.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-4.2.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64"
        },
        "product_reference": "helm-bash-completion-4.2.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-4.2.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64"
        },
        "product_reference": "helm-fish-completion-4.2.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-4.2.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le"
        },
        "product_reference": "helm-fish-completion-4.2.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-4.2.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x"
        },
        "product_reference": "helm-fish-completion-4.2.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-4.2.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64"
        },
        "product_reference": "helm-fish-completion-4.2.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-4.2.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64"
        },
        "product_reference": "helm-zsh-completion-4.2.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-4.2.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le"
        },
        "product_reference": "helm-zsh-completion-4.2.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-4.2.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x"
        },
        "product_reference": "helm-zsh-completion-4.2.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-4.2.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
        },
        "product_reference": "helm-zsh-completion-4.2.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50163",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50163"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50163",
          "url": "https://www.suse.com/security/cve/CVE-2026-50163"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271462 for CVE-2026-50163",
          "url": "https://bugzilla.suse.com/1271462"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50163"
    },
    {
      "cve": "CVE-2026-56864",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56864"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56864",
          "url": "https://www.suse.com/security/cve/CVE-2026-56864"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275025 for CVE-2026-56864",
          "url": "https://bugzilla.suse.com/1275025"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56864"
    },
    {
      "cve": "CVE-2026-56865",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56865"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
          "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56865",
          "url": "https://www.suse.com/security/cve/CVE-2026-56865"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275024 for CVE-2026-56865",
          "url": "https://bugzilla.suse.com/1275024"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:helm-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-bash-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-fish-completion-4.2.4-1.1.x86_64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.aarch64",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.ppc64le",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.s390x",
            "openSUSE Tumbleweed:helm-zsh-completion-4.2.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56865"
    }
  ]
}

CVE-2026-50163 (GCVE-0-2026-50163)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:36 – Updated: 2026-07-20 15:01

Title

oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 15:00 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/pull/1232	x_refsource_MISC
https://github.com/oras-project/oras-go/commit/c4…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oras-project	oras-go	Affected: < 2.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50163",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T15:00:48.168210Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T15:01:16.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:36:01.254Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp"
        },
        {
          "name": "https://github.com/oras-project/oras-go/pull/1232",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/pull/1232"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-fxhp-mv3v-67qp",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50163",
    "datePublished": "2026-07-17T19:36:01.254Z",
    "dateReserved": "2026-06-03T20:54:20.432Z",
    "dateUpdated": "2026-07-20T15:01:16.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56864 (GCVE-0-2026-56864)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16

Title

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Summary

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:16 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/issue/80745
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/815000
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6180

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb	Affected: 0 , < 0.40.0 (semver)

Credits

mundur

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:16:37.911009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:16:42.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb",
          "product": "golang.org/x/mod/sumdb",
          "programRoutines": [
            {
              "name": "Client.Lookup"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "mundur"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.605Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80745"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/815000"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6180"
        }
      ],
      "title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56864",
    "datePublished": "2026-08-13T21:58:53.605Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T16:16:42.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56865 (GCVE-0-2026-56865)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34

Title

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Summary

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:33 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/issue/80744
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814960
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6179

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb/tlog	Affected: 0 , < 0.40.0 (semver)

Credits

Filippo Valsorda (Geomys)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:33:28.143873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:34:17.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb/tlog",
          "product": "golang.org/x/mod/sumdb/tlog",
          "programRoutines": [
            {
              "name": "tileHashReader.ReadHashes"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Filippo Valsorda (Geomys)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.475Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80744"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814960"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6179"
        }
      ],
      "title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56865",
    "datePublished": "2026-08-13T21:58:53.475Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T15:34:17.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

OPENSUSE-SU-2026:11575-1

CVE-2026-50163 (GCVE-0-2026-50163)

CVE-2026-56864 (GCVE-0-2026-56864)

CVE-2026-56865 (GCVE-0-2026-56865)

Tags

Sightings

Nomenclature