CVE-2026-39822: 
Go 취약성 분석 및 완화

CVE-2026-39822 is a UNIX symbolic link (symlink) following vulnerability in the Go standard library's os package that allows directory traversal outside of an os.Root-constrained directory on Unix systems. When the final path component is a symlink and the path ends with a trailing slash (e.g., root.Open("symlink/")), the implementation improperly follows the symlink to locations outside the intended root boundary. Affected versions include Go before 1.25.12, Go 1.26.0–1.26.4, and Go 1.27.0-rc1. It was published on July 8, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper link resolution before file access (CWE-59 / CWE-61: UNIX Symbolic Link Following). The os.Root API, introduced to provide a chroot-like file access boundary in Go, fails to detect when a path component is a symlink pointing outside the root if the path is suffixed with a trailing /. Specifically, the trailing slash causes the path resolution logic to treat the symlink target as a directory, bypassing the symlink-escape check and resolving the file outside the intended root. Exploitation requires local access with low privileges and no user interaction. The issue is tracked upstream at go.dev/issue/79005 and fixed via changelist go.dev/cl/797880 (GitHub Advisory).

A local attacker with low privileges can read, and potentially write or corrupt, files outside the directory boundary enforced by os.Root, leading to unauthorized disclosure of sensitive files (confidentiality impact: High), possible modification of files outside the root (integrity impact: High), and potential disruption of services relying on file integrity (availability impact: High). Applications using os.Root to sandbox file access — such as container runtimes, file servers, or multi-tenant services — are most at risk, as the sandbox boundary can be silently bypassed (GitHub Advisory, Red Hat Bugzilla).

1. Identify target application: Locate a Go application on a Unix system that uses os.Root to restrict file access to a specific directory (e.g., a file server or container tool built with a vulnerable Go version before 1.25.12 or 1.26.5).
2. Create a malicious symlink: As a low-privileged local user with write access inside the root directory, create a symbolic link pointing to a sensitive location outside the root: ln -s /etc/shadow symlink_to_shadow.
3. Trigger the vulnerable code path: Cause the application to open the symlink with a trailing slash, e.g., by supplying a path like symlink_to_shadow/ to any application function that calls root.Open("symlink_to_shadow/").
4. Access out-of-root file: The Go runtime improperly resolves the trailing-slash path, follows the symlink outside the root, and opens the target file (e.g., /etc/shadow), granting the attacker read (or write) access to the sensitive resource (GitHub Advisory, go.dev issue).

• File System: Presence of symbolic links inside application-managed root directories pointing to sensitive paths outside the root (e.g., /etc/passwd, /etc/shadow, private key directories).
• Logs: Application logs showing file open operations on paths ending with / that resolve to files outside the expected root directory; unexpected access to sensitive system files by Go application processes.
• Process: Go application processes accessing files in /etc/, /root/, or other sensitive directories not normally within their operational scope.
• Audit: Linux auditd records (if configured) showing openat or open syscalls by the Go application process resolving to paths outside the designated root directory.

Upgrade to a patched version of Go: 1.25.12 or later for the 1.25.x branch, 1.26.5 or later for the 1.26.x branch, or 1.27.0-rc.2 or later for pre-release 1.27.x. Red Hat has issued multiple errata addressing this issue for RHEL 8, 9, and 10 (RHSA-2026:37435, RHSA-2026:37436, RHSA-2026:38493–38495, RHSA-2026:38878, RHSA-2026:38995). SUSE and openSUSE have also released updates (SUSE-SU-2026:2817-1, SUSE-SU-2026:3046-1, SUSE-SU-2026:3102-1, SUSE-SU-2026:3151-1). As a workaround where patching is not immediately possible, restrict the ability of low-privileged users to create symlinks inside application-managed directories using filesystem permissions or mandatory access controls (e.g., SELinux, AppArmor) (GitHub Advisory, Red Hat Bugzilla).

The Go team disclosed the vulnerability via the golang-announce mailing list and published a fix and advisory through the official Go vulnerability database (GO-2026-4970). Red Hat promptly triaged the issue and released multiple errata within days of disclosure, reflecting the broad impact on Go-based packages in enterprise Linux distributions. A Reddit post in r/pwnhub noted the issue, and the Defcon.social Mastodon community also discussed it, though overall community reaction has been measured given the absence of public exploits.