CVE-2026-4660
Fixed in a distro release EPSS <1%CVSS 7.5
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Products: HashiCorp Tooling, Red Hat Trusted Artifact Signer 1.3, Red Hat OpenShift Container Platform 4, Red Hat Trusted Artifact Signer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/go-getter | 1.8.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cg | 0.2.246-r1 |
| Chainguard | chainctl | 0.2.248-r0 |
| Chainguard | chainctl-fips | 0.2.247-r0 |
| Chainguard | cloudbeat-8.17 | 8.17.10-r14 |
| Chainguard | cloudbeat-8.18 | no fix |
| Chainguard | cloudbeat-8.19 | 8.19.13-r8 |
| Chainguard | cloudbeat-9.0 | no fix |
| Chainguard | cloudbeat-9.1 | 9.1.10-r9 |
| Chainguard | cloudbeat-9.2 | 9.2.7-r5 |
| Chainguard | cloudbeat-9.3 | 9.3.3-r2 |
| Chainguard | cloudbeat-fips-8.17 | 8.17.10-r33 |
| Chainguard | cloudbeat-fips-8.18 | no fix |
| Chainguard | cloudbeat-fips-8.19 | 8.19.13-r6 |
| Chainguard | cloudbeat-fips-9.0 | no fix |
| Chainguard | cloudbeat-fips-9.1 | 9.1.10-r20 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r4 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.7-r8 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.2-r8 |
| Chainguard | conftest | 0.68.2-r0 |
| Chainguard | conftest-fips | 0.68.2-r0 |
| Chainguard | crossplane-provider-terraform | 1.1.1-r11 |
| Chainguard | crossplane-provider-terraform-fips | 1.1.1-r8 |
| Chainguard | grype | 0.111.0-r3 |
| Chainguard | grype-db | 0.53.3-r5 |
| Chainguard | grype-fips | 0.112.0-r6 |
| Chainguard | k9s | 0.50.18-r18 |
| Chainguard | k9s-fips | 0.50.18-r14 |
| Chainguard | kots | 1.130.0-r4 |
| Chainguard | kubescape | 4.0.5-r0 |
| Chainguard | kubescape-server | 4.0.5-r0 |
| Chainguard | kubescape-server-downloader | 4.0.5-r0 |
| Chainguard | kubescape-server-fips | 4.0.5-r0 |
| Chainguard | kubescape-server-fips-downloader | 4.0.5-r0 |
| Chainguard | opentofu-1.10 | 1.10.10-r1 |
| Chainguard | opentofu-1.11 | 1.11.6-r1 |
| Chainguard | opentofu-1.8 | no fix |
| Chainguard | opentofu-1.9 | no fix |
| Chainguard | opentofu-fips-1.10 | 1.10.9-r11 |
| Chainguard | opentofu-fips-1.11 | 1.11.8-r1 |
| Chainguard | opentofu-fips-1.8 | no fix |
| Chainguard | opentofu-fips-1.9 | no fix |
| Chainguard | packer | 1.15.3-r8 |
| Chainguard | packer-fips | 1.15.3-r7 |
| Chainguard | snyk-cli | 1.1304.0-r2 |
| Chainguard | steampipe | 2.4.4-r2 |
| Chainguard | steampipe | 2.4.1-r2 |
| Chainguard | syft | 1.42.4-r2 |
| Chainguard | syft-fips | 1.42.4-r1 |
| Chainguard | task | 3.50.0-r0 |
| Chainguard | task-fips | 3.50.0-r0 |
| Chainguard | terraform | 1.5.7-r47 |
| Chainguard | terraform-1.10 | no fix |
| Chainguard | terraform-1.11 | no fix |
| Chainguard | terraform-1.12 | no fix |
| Chainguard | terraform-1.13 | 1.13.5-r13 |
| Chainguard | terraform-1.14 | 1.14.9-r0 |
| Chainguard | terraform-1.9 | no fix |
| Chainguard | terraform-fips-1.12 | no fix |
| Chainguard | terraform-fips-1.13 | 1.13.5-r18 |
| Chainguard | terraform-fips-1.14 | 1.14.9-r0 |
| Chainguard | terragrunt | 1.0.1-r0 |
| Chainguard | terragrunt-fips | 1.0.1-r0 |
| Chainguard | tflint | 0.62.1-r2 |
| Chainguard | tflint-fips | 0.62.1-r2 |
| Chainguard | tfsec | 1.28.14-r35 |
| Chainguard | trivy | 0.69.3-r12 |
| Chainguard | trivy-fips | 0.69.3-r7 |
| Chainguard | trivy-operator | 0.30.1-r6 |
| Chainguard | trivy-operator-fips | 0.30.1-r5 |
| Chainguard | wolfictl | 0.39.10-r0 |
| Chainguard | xeol | 0.10.8-r34 |
| Chainguard | xeol-fips | 0.10.8-r32 |
| Chainguard | zarf | 0.77.0-r0 |
| Chainguard | zarf-fips | 0.74.2-r5 |
| Chainguard | zot | 2.1.15-r12 |
| Debian 12 | golang-github-hashicorp-go-getter | no fix |
| Ubuntu 18.04 LTS | golang-github-hashicorp-go-getter | no fix |
| Ubuntu 20.04 LTS | golang-github-hashicorp-go-getter | no fix |
| Ubuntu 22.04 LTS | golang-github-hashicorp-go-getter | no fix |
| Ubuntu 24.04 LTS | golang-github-hashicorp-go-getter | no fix |
| Ubuntu 25.10 | golang-github-hashicorp-go-getter | no fix |
| Wolfi | conftest | 0.68.2-r0 |
| Wolfi | grype | 0.111.0-r3 |
| Wolfi | k9s | 0.50.18-r18 |
| Wolfi | kots | 1.130.0-r4 |
| Wolfi | kubescape | 4.0.5-r0 |
| Wolfi | opentofu-1.10 | 1.10.10-r1 |
| Wolfi | opentofu-1.11 | 1.11.6-r1 |
| Wolfi | opentofu-1.9 | no fix |
| Wolfi | snyk-cli | 1.1304.0-r2 |
| Wolfi | steampipe | 2.4.1-r2 |
| Wolfi | steampipe | 2.4.4-r2 |
| Wolfi | syft | 1.42.4-r2 |
| Wolfi | task | 3.50.0-r0 |
| Wolfi | terraform | 1.5.7-r47 |
| Wolfi | terragrunt | 1.0.1-r0 |
| Wolfi | tflint | 0.62.1-r2 |
| Wolfi | tfsec | 1.28.14-r35 |
| Wolfi | trivy | 0.69.3-r12 |
| Wolfi | trivy-operator | 0.30.1-r6 |
| Wolfi | wolfictl | 0.39.10-r0 |
| Wolfi | xeol | 0.10.8-r34 |
| Wolfi | zarf | 0.77.0-r0 |
| Wolfi | zot | 2.1.15-r12 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |