CVE-2026-4660: HashiCorp go-getter arbitrary file read via argument injection in Git URLs

CVE-2026-4660 · Severity: high · CVSS 7.5 · Published 2026-04-09

HashiCorp go-getter is a software library used by various applications to download files and directories from the internet or internal repositories. A security flaw in this library allows an attacker to read sensitive files from the server or computer running the software by providing a specially crafted web address (URL). This could lead to the exposure of private configuration files, credentials, or other confidential data stored on the affected system.

Technologies: github.com/hashicorp/go-getter (Go), Red Hat OpenShift Container Platform 4, Red Hat Trusted Artifact Signer. Vendors: Go, HashiCorp, Red Hat.

Quick answers

Is CVE-2026-4660 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4660 being exploited in the wild.
How severe is CVE-2026-4660?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
github.com/hashicorp/go-getter (Go) < 1.8.6, SEMVER:introduced=0,fixed=1.8.6; HashiCorp Go-Getter < 1.8.6; Red Hat OpenShift Container Platform 4 4.16, 4.17, 4.18, 4.19, 4.20, 4.21; Red Hat Trusted Artifact Signer 1.3.
Is there a fix for CVE-2026-4660?
Yes. github.com/hashicorp/go-getter (Go): upgrade to 1.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4660 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4660?
Check whether you run github.com/hashicorp/go-getter (Go), HashiCorp Go-Getter, Red Hat OpenShift Container Platform 4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/hashicorp/go-getter (Go): upgrade to 1.8.6 or later
    go get github.com/hashicorp/go-getter@v1.8.6

Technical details

A vulnerability in HashiCorp's go-getter library (v1.x branch) stems from improper validation of Git URLs, leading to argument injection. When a Git URL is provided without a specific reference, the library attempts to determine the remote repository's HEAD by passing arguments to the local Git binary. An attacker can craft a malicious URL that injects additional Git arguments, which can be leveraged to read arbitrary files from the local filesystem where the library is executing. This issue is categorized as a path traversal (CWE-22) and information exposure (CWE-200) flaw. The vulnerability is fixed in version 1.8.6; the v2 branch of the library is not affected.

Affected products

  • HashiCorp go-getter < 1.8.6
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Red Hat OpenShift Container Platform 4 4.16, 4.17, 4.18, 4.19, 4.20, 4.21

Identifiers

  • CVE-2026-4660
  • GHSA-92mm-2pjq-r785
  • GO-2026-5058

Timeline

  • 2026-04-09: disclosed: Initial disclosure by HashiCorp
  • 2026-04-09: patched: Fixed in go-getter v1.8.6
  • 2026-06-08: advisory: Red Hat issued security advisory RHSA-2026:24478

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.