CVE-2026-41506

Published: Mag 08, 2026 Last Modified: Mag 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

522

Insufficiently Protected Credentials

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Applicable Platforms
Technologies: ICS/OT, Not Technology-Specific, Web Based
View CWE Details
https://github.com/go-git/go-git/releases/tag/v5.18.0
https://github.com/go-git/go-git/releases/tag/v5.18.0
https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2
https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2
https://github.com/go-git/go-git/security/advisories/GHSA-3…
https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963