# CVE-2026-4660: HashiCorp go-getter arbitrary file read via argument injection in Git URLs

Source: https://junglewise.ai/threats/cve-2026-4660-hashicorp-go-getter-arbitrary-file-read-via-argument-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4660 · Severity: high · CVSS 7.5 · Published 2026-04-09

HashiCorp go-getter is a software library used by various applications to download files and directories from the internet or internal repositories. A security flaw in this library allows an attacker to read sensitive files from the server or computer running the software by providing a specially crafted web address (URL). This could lead to the exposure of private configuration files, credentials, or other confidential data stored on the affected system.

Technologies: [github.com/hashicorp/go-getter (Go)](https://junglewise.ai/threats/technologies/github-com-hashicorp-go-getter), [Red Hat OpenShift Container Platform 4](https://junglewise.ai/threats/technologies/openshift-container-platform-4), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-4660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4660 being exploited in the wild.

**How severe is CVE-2026-4660?** High severity, with a CVSS score of 7.5, published 9 April 2026.

**Which products and versions are affected?** github.com/hashicorp/go-getter (Go) < 1.8.6, SEMVER:introduced=0,fixed=1.8.6; HashiCorp Go-Getter < 1.8.6; Red Hat OpenShift Container Platform 4 4.16, 4.17, 4.18, 4.19, 4.20, 4.21; Red Hat Trusted Artifact Signer 1.3.

**Is there a fix for CVE-2026-4660?** Yes. github.com/hashicorp/go-getter (Go): upgrade to 1.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4660 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4660?** Check whether you run github.com/hashicorp/go-getter (Go), HashiCorp Go-Getter, Red Hat OpenShift Container Platform 4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/hashicorp/go-getter (Go): upgrade to 1.8.6 or later

  ```sh
  go get github.com/hashicorp/go-getter@v1.8.6
  ```


## Technical details

A vulnerability in HashiCorp's go-getter library (v1.x branch) stems from improper validation of Git URLs, leading to argument injection. When a Git URL is provided without a specific reference, the library attempts to determine the remote repository's HEAD by passing arguments to the local Git binary. An attacker can craft a malicious URL that injects additional Git arguments, which can be leveraged to read arbitrary files from the local filesystem where the library is executing. This issue is categorized as a path traversal (CWE-22) and information exposure (CWE-200) flaw. The vulnerability is fixed in version 1.8.6; the v2 branch of the library is not affected.

## Affected products

- HashiCorp go-getter < 1.8.6
- Red Hat Red Hat Trusted Artifact Signer 1.3
- Red Hat Red Hat OpenShift Container Platform 4 4.16, 4.17, 4.18, 4.19, 4.20, 4.21

## Identifiers

- CVE-2026-4660
- GHSA-92mm-2pjq-r785
- GO-2026-5058

## Timeline

- 2026-04-09: disclosed: Initial disclosure by HashiCorp
- 2026-04-09: patched: Fixed in go-getter v1.8.6
- 2026-06-08: advisory: Red Hat issued security advisory RHSA-2026:24478

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311](https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311)
- [https://access.redhat.com/errata/RHSA-2026:24478](https://access.redhat.com/errata/RHSA-2026:24478)
- [https://access.redhat.com/security/cve/CVE-2026-4660](https://access.redhat.com/security/cve/CVE-2026-4660)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2456909](https://bugzilla.redhat.com/show_bug.cgi?id=2456909)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4660.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4660.json)

## Related threats

- [go-getter privilege escalation in archive decompression](https://junglewise.ai/threats/cve-2026-88922-go-getter-privilege-escalation-in-archive-decompression)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)