CVE-2026-4660

BRIEFING NOTE - CVE-2026-4660 OVERVIEW CVE-2026-4660 is a vulnerability in HashiCorp's go-getter library affecting versions up to v1.8.5. The flaw allows arbitrary file reads on the host file system during git operations when processing maliciously crafted URLs. The vulnerability is resolved in go-getter v1.8.6 and does not impact the go-getter/v2 branch. This affects any systems or applications utilizing the vulnerable go-getter library versions. SEVERITY This vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity, allowing relatively straightforward exploitation. The primary impact is confidentiality compromise through unauthorized file disclosure, though the vulnerability does not enable file modification or service disruption. The threat model assumes an attacker can craft and distribute malicious repository URLs. EXPLOITATION STATUS Current exploitation activity is minimal. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog, indicating no documented active exploitation in the wild. The EPSS score of 0.00015 indicates very low probability of exploitation, placing this vulnerability well below the median risk threshold. Community attention appears limited, with no significant public exploit code availability reported. Organizations should prioritize patching based on inventory of go-getter usage rather than active threat indicators.