Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-08T13:43:19 golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-601

A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-HTTP clone and fetch operations, leading to the unintended disclosure of user credentials.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-05-14T00:00:00Z RHSA-2026:17669 syft-main-1.44.0-0.3.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Fix deferred assisted/agent-preinstall-image-builder-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-controller-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-git-cloner-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-image-bundler-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-image-processing-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-waiters-rhel9 Builds for Red Hat OpenShift Fix deferred openshift-builds/openshift-builds-webhook-rhel9 Confidential Compute Attestation Fix deferred openshift-sandboxed-containers/osc-must-gather-rhel9 Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/agent-client-rhel9 Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/bitwarden-sdk-server-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-operator-bundle External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-operator-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-rhel9 Kernel Module Management Operator for Red Hat Openshift Fix deferred kmm/kernel-module-management-must-gather-rhel9 Logging Subsystem for Red Hat OpenShift Fix deferred openshift-logging/cluster-logging-rhel9-operator Logical Volume Manager Storage Fix deferred lvms4/lvms-must-gather-rhel9 Machine Deletion Remediation Operator Fix deferred workload-availability/machine-deletion-remediation-operator-bundle Machine Deletion Remediation Operator Fix deferred workload-availability/machine-deletion-remediation-rhel9-operator Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-log-reader-rhel8 Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-must-gather-rhel8 Migration Toolkit for Virtualization Fix deferred migration-toolkit-virtualization/mtv-must-gather-rhel8 Migration Toolkit for Virtualization Fix deferred mtv-candidate/mtv-must-gather-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/cluster-image-set-controller-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/must-gather-rhel9 Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-must-gather-rhel9 OpenShift API for Data Protection Fix deferred oadp/oadp-mustgather-rhel9 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-agent-base-rhel8 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-agent-base-rhel9 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Fix deferred ocp-tools-4/jenkins-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-resolvers-rhel8 OpenShift Serverless Fix deferred openshift-serverless-1/kn-client-kn-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-plugin-func-func-util-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/serverless-must-gather-rhel9 OpenShift Serverless Fix deferred openshift-serverless-clients OpenShift Service Mesh 2 Fix deferred openshift-service-mesh/istio-must-gather-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/istio-must-gather-rhel9 Pen Drive Powered by Red Hat Lightspeed Fix deferred pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Fix deferred pen-drive/pen-drive-scanner-rhel9 Power monitoring for Red Hat OpenShift Fix deferred openshift-power-monitoring/power-monitoring-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-must-gather-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/submariner-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/submariner-rhel9-operator Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-rhel8-operator Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-scanner-slim-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat AI Inference Server Fix deferred rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-24/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/aap-must-gather-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/aap-must-gather-rhel9 Red Hat Build of Kueue Fix deferred kueue/kueue-must-gather-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/alloy-rhel10 Red Hat Edge Manager 1 Fix deferred flightctl Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alert-exporter-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alert-exporter-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alertmanager-proxy-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alertmanager-proxy-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-api-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-api-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-cli-artifacts-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-cli-artifacts-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-db-setup-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-db-setup-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-api-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-api-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-worker-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-worker-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-pam-issuer-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-pam-issuer-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-periodic-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-periodic-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-telemetry-gateway-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-telemetry-gateway-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-userinfo-proxy-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-userinfo-proxy-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-worker-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-worker-rhel9 Red Hat Enterprise Linux 8 Fix deferred grafana Red Hat Enterprise Linux 9 Fix deferred grafana Red Hat Hardened Images Affected trivy Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-must-gather-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/rhai-cli-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred cri-o Red Hat OpenShift Container Platform 4 Fix deferred openshift Red Hat OpenShift Container Platform 4 Fix deferred openshift3/ose-cli Red Hat OpenShift Container Platform 4 Fix deferred openshift3/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift3/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Fix deferred openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/cnf-tests-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/kube-compare-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/lifecycle-agent-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/network-tools-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/numaresources-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/o-cloud-manager-operator-bundle Red Hat OpenShift Container Platform 4 Fix deferred openshift4/o-cloud-manager-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-baremetal-installer-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-cli-artifacts-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-cli-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-csi-driver-shared-resource-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-deployer-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-cni-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-daemon-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-intel-netsec-vsp-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-marvell-cp-agent-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-marvell-vsp-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-network-resources-injector-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-dpu-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-installer-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-local-storage-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-machine-os-images-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-olm-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-framework-tools-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-lifecycle-manager Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-lifecycle-manager-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-registry Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-registry-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-operator-sdk-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-secrets-store-csi-mustgather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-tests-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-tools-rhel7 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-tools-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ptp-must-gather-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift-clients Red Hat OpenShift Container Platform 4 Fix deferred openshift-kni/commatrix Red Hat OpenShift Container Platform 4 Fix deferred ose-azure-acr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred redhat/redhat-operator-index Red Hat Openshift Data Foundation 4 Fix deferred odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-cloudnative-pg-rhel9-operator Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-multicluster-rhel9-operator Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-must-gather-rhel9 Red Hat OpenShift Dev Workspaces Operator Fix deferred devworkspace/devworkspace-operator-bundle Red Hat OpenShift Dev Workspaces Operator Fix deferred devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift Dev Workspaces Operator Fix deferred devworkspace/devworkspace-rhel9-operator Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-agent-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-agent-rhel9 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-image-updater-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-image-updater-rhel9 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/gitops-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/gitops-rhel8-operator Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/gitops-rhel9 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/gitops-rhel9-operator Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/must-gather-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/must-gather-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/bridge-marker-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/cnv-containernetworking-plugins-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/cnv-must-gather-rhel8 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/cnv-must-gather-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/hyperconverged-cluster-operator-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/hyperconverged-cluster-webhook-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubemacpool-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubesecondarydns-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/multus-dynamic-networks-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/ovs-cni-plugin-rhel9 Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/osp-director-agent Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/osp-director-operator Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/osp-director-operator-bundle Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/osp-director-agent Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/osp-director-operator Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/osp-director-operator-bundle Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/openstack-operator-bundle Red Hat Trusted Artifact Signer Fix deferred rhtas/ec-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/gitsign-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-41506 https://nvd.nist.gov/vuln/detail/CVE-2026-41506 https://github.com/go-git/go-git/releases/tag/v5.18.0 https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2 https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963