VDB
RHSA-2026:54773
RHSA-2026:54773
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | Red Hat build of OpenTelemetry | |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x as a component of Red Hat OpenShift distributed tracing 3.10.2 | * |
Timeline
- Aug 13, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54773 advisory
- https://access.redhat.com/security/cve/CVE-2026-39822 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42505 advisory
- https://access.redhat.com/security/cve/CVE-2026-46600 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54773.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39822 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39822 advisory
- https://go.dev/cl/797880 advisory
- https://go.dev/issue/79005 advisory
- https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc advisory
- https://pkg.go.dev/vuln/GO-2026-4970 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
- https://www.cve.org/CVERecord?id=CVE-2026-41178 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41178 advisory
- https://github.com/open-telemetry/opentelemetry-go/pull/7880 advisory
…and 19 more