VDB
RHSA-2026:59202
RHSA-2026:59202
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:bcd7c5f40c35376a3525d2ad17dd842e4ce2ac6a3fea017b1fa6ff79c0f21368_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:67d5c0b4730b0dce61aea2edc4f4ca9bf82df5381a8b8b34ac1e683c3224ad04_amd64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:f1de7ff333ca631ef030257f9a15828e3ed45f512534361fc5e00e8a7ee7337f_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:caac0035f166cae79d5be4a7084e8f42cf23efb8dfd1df63e8e294f29ecdce7b_ppc64le as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:6a8e091c8c3f3ddefb3763fc8bc64940ade011207482ae619700715e19e4ec45_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:5b96e28eabb3b7d40db9cff48c0aa1c45783e7b337c58406cd5c9565f23006e2_s390x as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:4e6b9c3daa151288545958cfe856902f9b5e26d50e45366d8be46acc10be32a3_ppc64le as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:f38aed9be9df9dec079c5092986de018ba29397087e1b3d0e1ceba2940fafecf_amd64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:d266ddb06f3e9c4f0ff8b1f7cafb73898f6e807a4a0c74c81c4aedd2c4490663_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:11c7f5d05e375731172fd6d26eb2b30a29142974a92488d45ccaddcfd708a3b1_s390x as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:3d464a1064bf24609956c122f75f90aef60d6f4cde97a3e7a9dc4de1fd308469_ppc64le as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:f2924a1724c6e0b79dede1e9c88de322739773ab28c5479c3cd19136717c3f1a_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8@sha256:9991c7a02205906070ef20c4fefedc736854762b1a1622d7d90af37447010f3a_amd64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:56ea592bab960f3704dd3bff8ee31b1846d8310903ab5ea41e7a6b2d6e15d0df_ppc64le as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:7f29f017e737a868ec4b0d9a2afda102d0451b8601059bee4447667d51d6cf65_ppc64le as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:797ecb9fda4d0005218cab00b331fab88841f63376889ec9ea121ba67a7fd2b8_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c5a67900cf6ebbbbaf24f777678a3457588f3a839f5caa0652b3d3dc149aa2b8_amd64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:d55400d4e004a1310b774443cd25fb8b6bdf3e8f9e5af24e00ee26d0012b34a9_amd64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1a45d114f30403942d6e5e3b2460b7e2dd03df50abfa8e52fa9986fc1908fc3b_arm64 as a component of Red Hat Advanced Cluster Security 4.9 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:39a29d77fd7cdf692e0e41a3bdae2aef514244decbf2c28d6979cd21d1810bea_s390x as a component of Red Hat Advanced Cluster Security 4.9 | * |
…and 25 more
Timeline
- Aug 24, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59202 advisory
- https://access.redhat.com/security/cve/CVE-2026-39822 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.9/html-single/release_notes/index#about-this-release-4911_release-notes-49 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59202.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39822 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39822 advisory
- https://go.dev/cl/797880 advisory
- https://go.dev/issue/79005 advisory
- https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc advisory
- https://pkg.go.dev/vuln/GO-2026-4970 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42504 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42504 advisory
- https://go.dev/cl/774481 advisory
- https://go.dev/issue/79217 advisory
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw advisory
…and 9 more