CVE-2026-41506 go-git Credential leak via cross-host redirect in smart HTTP transport

What is CVE-2026-41506?

CVE-2026-41506 is a medium-severity vulnerability in go-git, published on 8 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Weakness: CWE-522

Which versions are affected by CVE-2026-41506?

5 open source packages ship an affected version, including github.com/go-git/go-git/v5 and github.com/go-git/go-git/v6. It affects 1 product.

Products include Go-Git Project Go-Git.

How do I fix CVE-2026-41506?

Upgrade github.com/go-git/go-git/v5 to 5.18.0 or later.

Is CVE-2026-41506 being exploited?

There is no known exploitation of CVE-2026-41506 in the wild and no public exploit code.

Other vulnerabilities in go-git

• CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients Critical 9.8
• CVE-2025-21613 go-git has an Argument Injection via the URL field Critical 9.2
• CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies High 7.5
• CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients High 7.5
• CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git High 7.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-EZ09259, CLEANSTART-2026-LM14651, CLEANSTART-2026-WN28156, CLEANSTART-2026-ZC93700, DEBIAN-CVE-2026-41506, GHSA-3xc5-wrhm-f963 and 133 more.