CVE-2026-41506

Published: May 8, 2026Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 4.0

Source: NVD

Description

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Affected (2)

Products: Go Git Project: Go Git

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Go Git Project Go Git	Before 5.18.0
Go Git Project Go Git	Version 6.0.0 alpha1

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (3)

https://github.com/go-git/go-git/releases/tag/v5.18.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.