CVE-2026-41506: go-git Credential leak via cross-host redirect in smart HTTP transport
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41506?
CVE-2026-41506 is classified as a high severity vulnerability due to the potential for credential leakage.
How do I fix CVE-2026-41506?
To fix CVE-2026-41506, upgrade go-git to version 5.18.0 or 6.0.0-alpha.2 or later.
What are the impacts of CVE-2026-41506?
CVE-2026-41506 can lead to unauthorized access if HTTP authentication credentials are leaked during redirects.
What versions of go-git are affected by CVE-2026-41506?
CVE-2026-41506 affects all versions of go-git prior to 5.18.0 and 6.0.0-alpha.2.
How does CVE-2026-41506 occur in go-git?
CVE-2026-41506 occurs when go-git follows HTTP redirects during clone and fetch operations, potentially leaking credentials.