Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
Historical advisory recorded 3 Nov 2026 19:57:16 UTC. Read the latest advisory.
cve-program · CVE-2026-92615
PublishedA flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-92615
PublishedFlightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations.
- Source published
- 16 Sep 2026 15:20:50 UTC
- Source modified
- 3 Nov 2026 18:32:41 UTC
- Saved here
- 3 Nov 2026 19:57:16 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N