CVE-2026-4660: HashiCorp's go-getter Library Arbitrary File Read Vulnerability
Summary
CVE-2026-4660: HashiCorp's go-getter library may allow arbitrary file reads. Affects github.com/hashicorp/go-getter versions < 1.8.6. Fixed in 1.8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The go-getter library by HashiCorp is a Go package designed to facilitate the retrieval of files from various sources, including Git repositories. It is widely used in applications that require fetching and managing remote resources. The library's functionality is crucial for developers who need to automate the process of obtaining files, but it also introduces security risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2026-4660 affects versions of the go-getter library up to v1.8.5. It allows for arbitrary file reads on the file system during certain git operations when a maliciously crafted URL is used. This could lead to unauthorized access to sensitive files on the server where the application is running. The issue arises from improper validation of input URLs, which can be exploited by attackers to read files outside of the intended scope.
How To Fix
Latest published version: v1.8.10 as of 23 Oct 2026
go get github.com/hashicorp/go-getter@v1.8.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.6
This is the first release that contains the fix.
go get github.com/hashicorp/go-getter@v1.8.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting the URLs that can be processed by the go-getter library to trusted sources only. This can help mitigate the risk of exploitation until the library is updated.
Conclusion
The CVE-2026-4660 vulnerability in HashiCorp's go-getter library poses a significant risk by allowing arbitrary file reads through malicious URLs. It is crucial for developers using this library to update to version 1.8.6 or later to protect their applications from potential exploitation.
See every vulnerability recorded for github.com/hashicorp/go-getter →
FAQ
CVE-2026-4660 is a vulnerability in HashiCorp's go-getter library that allows for arbitrary file reads due to improper URL handling.
Versions of the go-getter library up to v1.8.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot update the library right away, restrict the URLs processed by the go-getter library to trusted sources to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-getter.
