{"id":"GO-2026-5890","revision":"6cde7d0c6e4144d285fe6549a4744de7","records":[{"revision":"6cde7d0c6e4144d285fe6549a4744de7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5890","aliases":["CVE-2026-50192","GHSA-h5gx-45rj-2h5j"],"title":"Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery","description":"Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery","state":0,"publishedAt":"2026-07-07T15:26:37+00:00","modifiedAt":"2026-07-07T16:01:31.6921747+00:00","affected":[{"ecosystem":"Go","name":"github.com/kerberos-io/agent/machinery","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260528173546-51f1a52e170f"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5890","license":"OSV · upstream source license applies","key":"osv:GO-2026-5890","identifiers":["GO-2026-5890","CVE-2026-50192","GHSA-h5gx-45rj-2h5j"]},"retained":false,"historicalAffected":[]}],"coverage":[]}