GO-2026-6604Published

Root.Mkdir(All) can follow junctions out of the root on Windows in os

cve-program · CVE-2026-56857

Published

os

https://pkg.go.dev

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Go standard library",
                    "product": "os",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "os",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "1.26.9",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "1.27.0-0",
                            "lessThan": "1.27.2",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "platforms": [
                        "windows"
                    ],
                    "programRoutines": [
                        {
                            "name": "Root.Mkdir"
                        },
                        {
                            "name": "doInRoot"
                        },
                        {
                            "name": "rootMkdirAll"
                        },
                        {
                            "name": "Root.Chmod"
                        },
                        {
                            "name": "Root.Chown"
                        },
                        {
                            "name": "Root.Chtimes"
                        },
                        {
                            "name": "Root.Lchown"
                        },
                        {
                            "name": "Root.Link"
                        },
                        {
                            "name": "Root.MkdirAll"
                        },
                        {
                            "name": "Root.Remove"
                        },
                        {
                            "name": "Root.RemoveAll"
                        },
                        {
                            "name": "Root.Rename"
                        },
                        {
                            "name": "Root.Symlink"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

internal/syscall/windows

https://pkg.go.dev

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Go standard library",
                    "product": "internal/syscall/windows",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "internal/syscall/windows",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "1.26.9",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "1.27.0-0",
                            "lessThan": "1.27.2",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "platforms": [
                        "windows"
                    ],
                    "programRoutines": [
                        {
                            "name": "Mkdirat"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-95420

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Oct 8, 2026, 10:53:58 PM

dateUpdated: Oct 9, 2026, 3:36:01 PM

14 related source bulletins · separate from aliases

RHSA-2026:92480: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.14

CVE-2026-56857 · CVE-2026-56866 · CVE-2026-78663 · CVE-2026-78667 · CVE-2026-78669 · CVE-2026-94439 · CVE-2026-94440 · CVE-2026-94448 · CVE-2026-97030 · CVE-2026-97031 · CVE-2026-97032 · CVE-2026-111943

RHSA-2026:92451: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.17

RHSA-2026:92497: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.11

RHSA-2026:92516: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.4.4

openSUSE-SU-2026:22093-1: Security update for go1.27

CVE-2026-56857 · CVE-2026-56866 · CVE-2026-78659 · CVE-2026-78660 · CVE-2026-78663 · CVE-2026-78667 · CVE-2026-78669 · CVE-2026-94439 · CVE-2026-94440 · CVE-2026-94444 · CVE-2026-94447 · CVE-2026-94448 · CVE-2026-97030 · CVE-2026-97031 · CVE-2026-97032

SUSE-SU-2026:24237-1: Security update for go1.27

RHSA-2026:92509: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.9

openSUSE-SU-2026:12101-1: go1.27-1.27.2-1.1 on GA media

WID-SEC-W-2026-3841: Golang Go: Mehrere Schwachstellen

msrc_CVE-2026-56857: Root.Mkdir(All) can follow junctions out of the root on Windows in os

CVE-2026-56857

openSUSE-SU-2026:22095-1: Security update for go1.26

CVE-2026-56857 · CVE-2026-56866 · CVE-2026-78659 · CVE-2026-78660 · CVE-2026-78667 · CVE-2026-94439 · CVE-2026-94440 · CVE-2026-94444 · CVE-2026-94447 · CVE-2026-94448 · CVE-2026-97030 · CVE-2026-97031 · CVE-2026-97032

openSUSE-SU-2026:12093-1: go1.26-1.26.9-1.1 on GA media

openSUSE-SU-2026:12112-1: rclone-1.75.2-1.1 on GA media

CVE-2026-56857 · CVE-2026-56866 · CVE-2026-78659 · CVE-2026-78660 · CVE-2026-78663 · CVE-2026-78667 · CVE-2026-78669 · CVE-2026-84445 · CVE-2026-94439 · CVE-2026-94440 · CVE-2026-94444 · CVE-2026-94447 · CVE-2026-94448 · CVE-2026-97030 · CVE-2026-97031 · CVE-2026-97032

SUSE-SU-2026:24239-1: Security update for go1.26

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-56857

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-1386

Original publisher date fields

published: 2026-10-08T23:17:01.487

lastModified: 2026-10-09T16:35:35.900

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-6604

Published

stdlib

SEMVER · introduced 0 → fixed 1.26.9 → introduced 1.27.0-0 → fixed 1.27.2

Original source record · Cite this exact observation · Complete original publisher JSON