CVE-2026-41506
MEDIUMgo-git Credential leak via cross-host redirect in smart HTTP transport
Title source: cnaDescription
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963
X_Refsource_Misc x_refsource_misc
https://github.com/go-git/go-git/releases/tag/v5.18.0
X_Refsource_Misc x_refsource_misc
https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2
Scores
CVSS v3
4.7
EPSS
0.0026
EPSS Percentile
17.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-522
Status
published
Products (6)
go-git/go-git
0 - 5.18.0Go
go-git/go-git
0 - 6.0.0-alpha.2Go
go-git/go-git
< 5.18.0
go-git/go-git
< 6.0.0-alpha.2
go-git_project/go-git
6.0.0 alpha1
go-git_project/go-git
< 5.18.0
Published
May 08, 2026
Tracked Since
May 08, 2026