CVE-2026-41506 Details
Description
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
A vulnerability in the go-git library, affecting versions through 5.17.2 and 6.0.0-alpha.1, may lead to the unintentional leakage of HTTP authentication credentials. This occurs when the library follows redirects during smart-HTTP clone and fetch operations, potentially sending credentials to an unintended host. The issue arises when interacting with untrusted or misconfigured Git servers over unsecured HTTP connections. Clients using go-git with trusted remotes like GitHub or GitLab over secure HTTPS are not affected.
Users should upgrade to go-git version 5.18.0 or 6.0.0-alpha.2. The patched versions include support for configuring the followRedirects policy, with the default set to 'initial'. Users can programmatically opt into 'FollowRedirects' or 'NoFollowRedirects'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-git/go-git/releases/tag/v5.18.0 | [email protected] | ProductRelease Notes |
| https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2 | [email protected] | ProductRelease Notes |
| https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| go-git project go-git | < 5.18.0 6.0.0 alpha1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |