CVE-2026-56857

Red Hat rates this flaw as LOW severity. A flaw was found in the Go standard library's scoped filesystem implementation (os.Root) on Windows. When Root.Mkdir or Root.MkdirAll is called and the final path component of the target is an NTFS junction that points to an empty location outside the designated root directory, the operation follows the junction and creates a directory outside the restricted boundary, bypassing the intended directory confinement. The issue only applies when the last path component is a junction (path/to/junction, but not path/junction/target), and only to Go programs running on Windows. Exploitation requires local filesystem access with standard unprivileged user privileges to plant the junction that a Go application using these scoped operations then targets; no user interaction is required. Successful exploitation allows an attacker to create unauthorized directories outside the root (low integrity impact), with no impact on confidentiality or availability, and without crossing security-authority boundaries. Red Hat products shipping the Go toolchain or Go-based components are recorded as affected, including Red Hat Enterprise Linux, Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, Red Hat OpenStack Platform, Red Hat AMQ, and Red Hat Edge Manager, among other streams. Because the impact is LOW, fixes in affected Red Hat streams are deferred and no update trackers are filed for this severity, while some streams outside full support scope are resolved as out of support scope; the residual risk is limited to Windows deployments of Go applications that rely on os.Root confinement in environments where untrusted local users can create NTFS junctions. Red Hat's LOW rating (CVSS 3.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) differs significantly from the CISA score of 9.8, which does not reflect the local access and privileges required to exploit this issue or its directory-creation-only consequence.