Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T15:46:27 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-59

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

A flaw was found in Go's os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open("symlink/")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. The following symbols are affected: * `OpenInRoot`: Opens a file or directory within an `os.Root`. * `Root.Create`: Creates a file inside an `os.Root`. * `Root.Open`: Opens a path relative to an `os.Root`. * `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`. * `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`. * `Root.ReadFile`: Reads a file inside an `os.Root`. * `Root.WriteFile`: Writes a file inside an `os.Root`. There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Red Hat Enterprise Linux 10 2026-07-09T00:00:00Z RHSA-2026:37436 golang-0:1.26.5-1.el10_2 Red Hat Enterprise Linux 10 2026-07-13T00:00:00Z RHSA-2026:38494 buildah-2:1.43.1-4.el10_2 Red Hat Enterprise Linux 8 2026-07-13T00:00:00Z RHSA-2026:38995 go-toolset:rhel8-8100020260710105056.a3795dee Red Hat Enterprise Linux 9 2026-07-09T00:00:00Z RHSA-2026:37435 golang-0:1.26.5-1.el9_8 Red Hat Enterprise Linux 9 2026-07-13T00:00:00Z RHSA-2026:38493 buildah-2:1.43.1-4.el9_8 Red Hat Enterprise Linux 9 2026-07-13T00:00:00Z RHSA-2026:38878 podman-6:5.8.2-5.el9_8 Red Hat Hardened Images 2026-07-08T00:00:00Z RHSA-2026:36477 golang1-26-main-1.26.5-0.1.hum1 Red Hat Hardened Images 2026-07-08T00:00:00Z RHSA-2026:36510 golang1-25-main-1.25.12-0.1.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Not affected rhai/assisted-installer-rhel9 Builds for Red Hat OpenShift Not affected openshift-builds/openshift-builds-waiters-rhel9 cert-manager Operator for Red Hat OpenShift Not affected cert-manager/jetstack-cert-manager-rhel9 Compliance Operator Not affected compliance/openshift-compliance-operator-bundle Confidential Compute Attestation Not affected build-of-trustee/trustee-rhel9-operator Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-monitor-rhel9 Cryostat 4 Not affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Deployment Validation Operator Not affected dvo/deployment-validation-rhel8-operator External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/external-secrets-rhel9 Fence Agents Remediation Operator Not affected workload-availability/fence-agents-remediation-rhel8-operator File Integrity Operator Not affected compliance/openshift-compliance-operator-bundle Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9-operator Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/eventrouter-rhel9 Logical Volume Manager Storage Not affected lvms4/lvms-rhel9-operator Logical Volume Manager Storage Not affected lvms4/topolvm-rhel8 Logical Volume Manager Storage Not affected lvms4/topolvm-rhel9 Machine Deletion Remediation Operator Not affected workload-availability/machine-deletion-remediation-rhel8-operator Migration Toolkit for Applications 8 Not affected mta/mta-cli-rhel9 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-registry-rhel8 mirror registry for Red Hat OpenShift 2 Not affected openshift/mirror-registry-rhel8 Multiarch Tuning Operator Not affected multiarch-tuning/multiarch-tuning-rhel9-operator Multicluster Engine for Kubernetes Not affected multicluster-engine/discovery-rhel9 Multicluster Engine for Kubernetes Not affected multicluster-engine/maestro-rhel9 Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-agent-rhel9 Network Observability Operator Not affected network-observability/network-observability-cli-rhel9 Node HealthCheck Operator Not affected node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8 OpenShift API for Data Protection Not affected oadp/oadp-velero-rhel9 OpenShift Developer Tools and Services Not affected helm OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-rhel9-operator OpenShift Pipelines Not affected openshift-pipelines-client OpenShift Pipelines Not affected openshift-pipelines/pipelines-scheduler-rhel9 OpenShift Serverless Not affected kn-workflow-plugin OpenShift Serverless Not affected openshift-serverless-1/kn-plugin-event-sender-rhel9 OpenShift Serverless Not affected openshift-serverless-1/logic-rhel9-operator OpenShift Serverless Not affected openshift-serverless-clients OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected rh-osbs/openshift-golang-builder OpenShift Source-to-Image (S2I) Not affected source-to-image/source-to-image-rhel8 Power monitoring for Red Hat OpenShift Not affected openshift-power-monitoring/kepler-rhel9 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/subctl-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/thanos-rhel9 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Affected advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Clients Not affected qpid-proton Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/receptor-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/receptor-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform/platform-operator-bundle Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy-openssl30 Red Hat Ansible Automation Platform 2 Not affected automation-gateway-proxy-openssl32 Red Hat Ceph Storage 5 Not affected rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 Not affected rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Not affected rhceph/alloy-rhel10 Red Hat Connectivity Link 1 Not affected rhcl-1/authorino-rhel9 Red Hat Connectivity Link 1 Not affected rhcl-1/coredns-rhel9 Red Hat Developer Hub Not affected rhdh/rhdh-rhel9-operator Red Hat Edge Manager 1 Not affected flightctl Red Hat Edge Manager 1 Not affected rhem/flightctl-ui-rhel9 Red Hat Enterprise Linux 10 Not affected conmon Red Hat Enterprise Linux 10 Affected podman Red Hat Enterprise Linux 10 Not affected python-awscrt Red Hat Enterprise Linux 10 Not affected rhel10/bootc-image-builder Red Hat Enterprise Linux 10 Not affected rhel10-eus/rhel-10.0-bootc-image-builder Red Hat Enterprise Linux 10 Not affected skopeo Red Hat Enterprise Linux 10 Not affected trustee Red Hat Enterprise Linux 10 Not affected trustee-guest-components Red Hat Enterprise Linux 7 Not affected rhc Red Hat Enterprise Linux 7 Not affected rhc-worker-script Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/conmon Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/containernetworking-plugins Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/oci-seccomp-bpf-hook Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/runc Red Hat Enterprise Linux 8 Not affected container-tools:rhel8/skopeo Red Hat Enterprise Linux 8 Not affected rhc Red Hat Enterprise Linux 9 Not affected conmon Red Hat Enterprise Linux 9 Not affected containernetworking-plugins Red Hat Enterprise Linux 9 Not affected golang-github-cpuguy83-md2man Red Hat Enterprise Linux 9 Not affected oci-seccomp-bpf-hook Red Hat Enterprise Linux 9 Not affected python-awscrt Red Hat Enterprise Linux 9 Not affected rhel9/bootc-image-builder Red Hat Enterprise Linux 9 Not affected rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 9 Not affected runc Red Hat Enterprise Linux 9 Not affected skopeo Red Hat Enterprise Linux 9 Not affected trustee-guest-components Red Hat Enterprise Linux AI (RHEL AI) 3 Affected golang Red Hat Hardened Images Not affected golang-fips1.25 Red Hat Lightspeed for Runtimes Operator Not affected rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-rhel9-operator Red Hat OpenShift AI (RHOAI) Not affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Cluster Manager CLI Not affected ocm-cli-clients/ocm-cli-rhel9 Red Hat OpenShift Container Platform 4 Not affected conmon Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Container Platform 4 Not affected containernetworking-plugins Red Hat OpenShift Container Platform 4 Not affected cri-o Red Hat OpenShift Container Platform 4 Not affected cri-tools Red Hat OpenShift Container Platform 4 Not affected golang-github-prometheus-promu Red Hat OpenShift Container Platform 4 Not affected kata-containers Red Hat OpenShift Container Platform 4 Affected openshift Red Hat OpenShift Container Platform 4 Not affected openshift4/frr-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-cli Red Hat OpenShift Container Platform 4 Not affected openshift-clients Red Hat OpenShift Container Platform 4 Not affected ose-aws-ecr-image-credential-provider Red Hat OpenShift Container Platform 4 Not affected ose-azure-acr-image-credential-provider Red Hat OpenShift Container Platform 4 Not affected ose-crio-credential-provider Red Hat OpenShift Container Platform 4 Not affected ose-gcp-gcr-image-credential-provider Red Hat OpenShift Container Platform 4 Affected rh-osbs/openshift-golang-builder Red Hat OpenShift Container Platform 4 Not affected runc Red Hat Openshift Data Foundation 4 Not affected odf4/cephcsi-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/udi-rhel9 Red Hat OpenShift Dev Workspaces Operator Not affected devworkspace/devworkspace-rhel9-operator Red Hat OpenShift distributed tracing 3 Not affected rhosdt/tempo-rhel9 Red Hat OpenShift for Windows Containers Not affected openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps Not affected openshift-gitops-1/dex-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/dex-rhel9 Red Hat OpenShift on AWS Not affected rosa Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-apiserver-proxy-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-redfish-rhel9 Red Hat OpenShift Virtualization 4 Not affected kubevirt Red Hat OpenShift Virtualization 4 Affected rh-osbs/openshift-golang-builder Red Hat OpenStack Platform 16.2 Not affected etcd Red Hat OpenStack Platform 16.2 Not affected golang-qpid-apache Red Hat OpenStack Platform 16.2 Not affected qpid-proton Red Hat OpenStack Platform 16.2 Not affected rhosp-rhel8/osp-director-agent Red Hat OpenStack Platform 17.1 Not affected etcd Red Hat OpenStack Platform 17.1 Not affected golang-qpid-apache Red Hat OpenStack Platform 17.1 Not affected qpid-proton Red Hat OpenStack Platform 17.1 Not affected rhosp-rhel9/osp-director-agent Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/sg-core-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Not affected dynflow-utils Red Hat Satellite 6 Not affected rubygem-dynflow Red Hat Satellite 6 Not affected satellite-capsule:el8/dynflow-utils Red Hat Satellite 6 Not affected satellite:el8/yggdrasil-worker-forwarder Red Hat Satellite 6 Not affected satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Not affected yggdrasil-worker-forwarder Red Hat Service Interconnect 2 Not affected skupper-router Red Hat Trusted Artifact Signer Not affected rhtas/ec-rhel9 Red Hat Web Terminal Not affected web-terminal/web-terminal-exec-rhel9 Security Profiles Operator Not affected compliance/openshift-selinuxd-rhel8 Service Telemetry Framework 1.5 Not affected stf/sg-core-rhel9 streams for Apache Kafka 2 Not affected golang-github-danielqsj-kafka_exporter streams for Apache Kafka 3 Not affected golang-github-danielqsj-kafka_exporter Zero Trust Workload Identity Manager Not affected zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9 Zero Trust Workload Identity Manager - Tech Preview Not affected zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-39822 https://nvd.nist.gov/vuln/detail/CVE-2026-39822 https://go.dev/cl/797880 https://go.dev/issue/79005 https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc https://pkg.go.dev/vuln/GO-2026-4970