Loading story…
A flaw in Go's standard library, tracked as CVE-2026-32282, allows Root.Chmod in internal/syscall/unix to follow a symbolic link outside the intended root on Linux because of a time-of-check/time-of-use race. Red Hat said a local attacker who can create symlinks and win the race could cause permission changes on the symlink target, potentially bypassing directory restrictions; the company rated the issue Moderate and noted no qualifying mitigation was available.
Red Hat has shipped fixes for the bug as part of broader Go security updates across multiple products, including podman, osbuild-composer, and golang-github-openstack-k8s-operators-os-diff used in Red Hat OpenStack Services on OpenShift and several RHEL 9.2/9.4 channels. The advisories also bundled patches for other Go-related issues affecting components such as crypto/tls, crypto/x509, net/url, net, and Go JOSE, covering denial-of-service conditions, certificate validation weaknesses, memory exhaustion, and incorrect IPv6 parsing.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:47910 for osbuild-composer and released version 101.3-4.el9_4.3 across several RHEL 9.4 channels and architectures. The Important-rated advisory fixes five Go vulnerabilities, including CVE-2026-32282 in internal/syscall/unix.
Red Hat published RHSA-2026:39810 for golang-github-openstack-k8s-operators-os-diff in Red Hat OpenStack Services on OpenShift 18.0, rated Important. The update includes fixes for multiple Go vulnerabilities, including CVE-2026-32282 affecting Root.Chmod symlink handling.
Red Hat published RHSA-2026:25248 for podman, rated Important, and released updated podman 4.4.1-22.el9_2.11 packages for multiple RHEL 9.2 channels and architectures. The advisory fixes several Go-related vulnerabilities, including CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2026-25679, and CVE-2026-34986.
Red Hat's CVE record says Cryostat 4 on RHEL 9 component cryostat/cryostat-storage-rhel9 was listed as fixed in RHSA-2026:14391. This extended remediation for the Go Root.Chmod issue to another downstream product.
Red Hat published a CVE page describing CVE-2026-32282 as a moderate-severity flaw in Go's internal/syscall/unix package. The page explains the TOCTOU race condition, notes there is no qualifying mitigation, and enumerates affected and fixed products.
Red Hat lists Red Hat Enterprise Linux 10 grafana in RHSA-2026:11712 and rhc-worker-playbook in RHSA-2026:11863 as fixed for CVE-2026-32282. Both fixes are recorded on the same day in the CVE entry.
Red Hat lists Red Hat Enterprise Linux 10 golang as fixed for CVE-2026-32282 in advisory RHSA-2026:10217. This is one of the first product fixes explicitly tied to the Go Root.Chmod vulnerability in the provided references.
Red Hat's CVE page for CVE-2026-32282 was last modified, reflecting updated tracking information for the Go Root.Chmod symlink-following issue. The entry includes severity, exploit conditions, and linked references such as Bugzilla 2456336 and Go issue 78293.
Red Hat's CVE record states that CVE-2026-32282, a TOCTOU race in Go's internal/syscall/unix Root.Chmod that can follow symlinks out of the intended root, was made public. The flaw can let a local attacker cause chmod to affect the symlink target instead of the checked file.
Red Hat lists Red Hat Enterprise Linux 10 yggdrasil as fixed for CVE-2026-32282 in RHSA-2026:17075. The fix is recorded in the CVE entry as another downstream remediation of the Go flaw.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed and patched **CVE-2026-39822**, an Important vulnerability in Go's `os.Root` handling on Unix systems that can improperly follow a symbolic link outside the intended root boundary, enabling directory traversal. The flaw is triggered when the final path component is a symlink and the supplied path ends with a trailing slash, such as `root.Open("symlink/")`, and Red Hat said fixes were prepared across multiple Red Hat Enterprise Linux releases, including **RHEL 8, RHEL 9, RHEL 10**, and Extended Update Support variants. Red Hat published July advisories covering affected container tooling, including **RHSA-2026:38878** for **podman** on RHEL 9 and **RHSA-2026:38493** and **RHSA-2026:38494** for **buildah** on RHEL 9 and RHEL 10. The updates deliver patched packages including **podman `5.8.2-5.el9_8`** and **buildah `1.43.1-4.el9_8`** and `1.43.1-4.el10_2`, with fixes released for multiple architectures and support channels such as x86_64, s390x, ppc64le, and aarch64.
Aug 26, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026