High7.8Red Hat Linux

High [CVE-2026-39822] Go os.Root: Symlink following vulnerability allows directory traversal

This high-severity Red Hat Linux advisory covers CVE-2026-39822 affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 1.

CVE-2026-39822 Published Jul 8, 2026Updated by vendor Jul 8, 2026

CVE-2026-39822

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Go os.Root: Symlink following vulnerability allows directory traversal. Red Hat rates this important (CVSS 7.8).

Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:44624 with package podman-6:5.8.2-5.el9_8, rhosdt/tempo-query-rhel9:1784775793, golang-0:1.26.5-1.el10_2, buildah-2:1.43.1-4.el10_2.

Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

podman-6:5.8.2-5.el9_8
rhosdt/tempo-query-rhel9:1784775793
golang-0:1.26.5-1.el10_2
buildah-2:1.43.1-4.el10_2
buildah-2:1.43.1-4.el9_8
rhosdt/tempo-jaeger-query-rhel9:1784775834
rhosdt/tempo-operator-bundle:1784777166
rhosdt/tempo-gateway-opa-rhel9:1784775772
rhosdt/tempo-rhel9-operator:1784775782
rhosdt/tempo-gateway-rhel9:1784775770
golang1-26-main-1.26.5-0.1.hum1
rhosdt/tempo-rhel9:1784775768
golang-0:1.26.5-1.el9_8
golang1-25-main-1.25.12-0.1.hum1
go-toolset:rhel8-8100020260710105056.a3795dee
RHSA-2026:44624

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation checklist

Recommended fix / mitigation

There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.