VDB
RHSA-2026:59203
RHSA-2026:59203
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:b5026e4fc9203f367c78250713883b2620bab241bbe03bf9544dd8cf38f91e18_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:4c286dbd7a19ba23ea7fd49eb8954f0877fca60c9e32b3c1dfc9bbf29c24c846_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:18618fd708fc639eee0a60e61a662bb39aa2b8ee7caed5b3d7d89b3ff206a40d_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:c1dec94846363c3123225588bae3f2c9fe7bdbeca8522d7a6deca42dd0462542_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8@sha256:07066c03b35781fe5b25693a517997fa2d0d1e39a51e6d0db24d9031621840b1_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:e4de2a94294c323bd029c693d539ffc9e11e0401a947dc49b512428852b23b47_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:586af1b1fd4f1f4e5ad98d51b361bf83af3866d2c80f2bea3aa276511f016e12_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8@sha256:f9e7080614fe5cb1195e281e8a49911f2531bca9172326e26d8d3a6607c4c099_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:feee253916fa10ae8ede30bc4bbe6b965e2e2cdb473b6525dfa3bb1e70f290a8_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:88ac62cb202f51ddf5c07d19719bc2317a9206d2df1285ef38bc8ef17b6a0f7a_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:f989ef464cea71a6ce090e99f3cd3549f666e8502074534c8dbfd5f480ff40ec_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:070b56aee8895f4c1777432111475a376f2a9f0c3dbf869d9361a8232298bb05_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:42fce168d48c2323e4e8cb012e3fcb529a8beb871ce7366565c99ddf33687775_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:06b97ae6636d7f60e193ca4c312a5575ce789619b16bbbc56d4a2ebe24b7aad7_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ba9c445ce5d8e0412092f513dacab7f393d4b35d1059cf580e677a3247795ee9_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:4cfac3dc0c224c1f49f4eab49d186aec22e4b5313402c875118887cd28409201_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:8ca00137187baa440d3c641ce7b198e7bd4494fb4660a0b97682f724f1d04354_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:4110c57e7e4e1e535678bf0e3cd4e541d0169e98d977c2f21c0c119537cd28be_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:2caf58917f349f5ad35e0a59fd82d2f3dfbdefa8e958392859289d2742a402a2_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8@sha256:5c42fe55f726a9a4159a2f1cd797eed1aa5e6fdcb254d41c3ac16cf405a0d741_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.10 | * |
…and 27 more
Timeline
- Aug 24, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:59203 advisory
- https://access.redhat.com/security/cve/CVE-2026-39822 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.10/html-single/release_notes/index#about-this-release-4107_release-notes-410 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59203.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39822 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39822 advisory
- https://go.dev/cl/797880 advisory
- https://go.dev/issue/79005 advisory
- https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc advisory
- https://pkg.go.dev/vuln/GO-2026-4970 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42504 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42504 advisory
- https://go.dev/cl/774481 advisory
- https://go.dev/issue/79217 advisory
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw advisory
…and 9 more