Is CVE-2026-56857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56857 being exploited in the wild.

How severe is CVE-2026-56857?

Critical severity, with a CVSS score of 9.8, published 8 October 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2; Google Go prior to fix.

Is there a fix for CVE-2026-56857?

Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56857 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-56857?

Check whether you run stdlib (Go) or Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56857: Go os.Root.Mkdir/MkdirAll junction escape on Windows

CVE-2026-56857 · Severity: critical · CVSS 9.8 · Published 2026-10-08

Go's os.Root.Mkdir and os.Root.MkdirAll functions on Windows can be tricked into creating directories outside their intended root directory by following filesystem junctions (a Windows feature similar to symlinks). An attacker who controls the filesystem layout could cause these functions to write files or directories in unexpected locations, potentially bypassing directory access controls.

Technologies: stdlib (Go), Google Go. Vendors: Go, Google.

Quick answers

Is CVE-2026-56857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56857 being exploited in the wild.
How severe is CVE-2026-56857?: Critical severity, with a CVSS score of 9.8, published 8 October 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2; Google Go prior to fix.
Is there a fix for CVE-2026-56857?: Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56857 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-56857?: Check whether you run stdlib (Go) or Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.2 or later
```
go get stdlib@v1.27.2
```

Technical details

The vulnerability occurs in Go's os package when the final path component is a junction pointing to an empty location on Windows. Root.Mkdir and Root.MkdirAll would resolve the junction and create directories at the target location outside the root, violating the security boundary. The issue only affects operations where the last path component is a junction (e.g., path/to/junction) but not intermediate junctions in the path. The fix modifies these functions to avoid resolving junctions entirely.

Affected products

Google Go prior to fix

Identifiers

CVE-2026-56857
GO-2026-6604

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.