CVE-2026-24686: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-24686 is a path traversal vulnerability in the TAP 4 Multirepo Client of go-tuf, a Go implementation of The Update Framework (TUF). The flaw allows an attacker who controls a TAP 4 map file to supply a malicious repoName containing traversal sequences (e.g., ../escaped-repo), causing go-tuf to write files outside the intended LocalMetadataDir cache directory. Affected versions are github.com/theupdateframework/go-tuf/v2 from 2.0.0 up to and including 2.4.0; version 2.4.1 contains the fix. The vulnerability was published on January 26, 2026, with a CVSS v3.1 base score of 4.7 (Moderate) (Github Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in metadata/multirepo/multirepo.go within the (*MultiRepoClient) initTUFClients() function. The vulnerable callsite constructs a metadata directory path as metadataDir := filepath.Join(client.Config.LocalMetadataDir, repoName) without validating repoName for path traversal sequences, absolute paths, or path separators. Exploitation requires: (1) the attacker can influence the TAP 4 map file content (e.g., via URL fetch, supply-chain substitution, or other untrusted input), (2) local caching is enabled (DisableLocalCache=false), and (3) LocalMetadataDir is writable by the running process. A proof-of-concept (poc.zip) was included in the advisory, demonstrating that a traversal repoName causes root.json to be persisted outside the intended cache base (Github Advisory, Patch Commit).

Successful exploitation enables arbitrary file writes within the filesystem permissions of the running process, with a high integrity impact and no confidentiality or availability impact per the CVSS scoring. An attacker can overwrite configuration files or other writable files accessible to the go-tuf process, potentially altering application behavior or enabling further compromise such as privilege escalation or remote code execution depending on the deployment environment. The practical impact is deployment-dependent: if the map file is always local and trusted, the risk is reduced to a misconfiguration issue, but in deployments where map files are fetched from untrusted sources, the impact ceiling is rated HIGH by the reporter (Github Advisory).

A proof-of-concept exploit (poc.zip) was included in the original security advisory, demonstrating the path traversal via crafted repoName values. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.006–0.009%, placing it in the 1st percentile for exploitation likelihood. Exploitability is deployment-dependent and requires the attacker to control or influence the TAP 4 map file content (Github Advisory).

1. Identify a vulnerable deployment: Locate an application using github.com/theupdateframework/go-tuf/v2 versions 2.0.0–2.4.0 with the TAP 4 multirepo client, local caching enabled (DisableLocalCache=false), and a writable LocalMetadataDir.
2. Gain control of the map file: Position the attacker-controlled map file to be loaded by the application — for example, by serving it from an attacker-controlled URL, performing a supply-chain substitution, or exploiting another vulnerability that allows file replacement.
3. Craft a malicious map file: Construct a TAP 4 map file JSON where the repositories key contains a traversal repoName, such as ../escaped-repo or ../../etc/cron.d/malicious, targeting a writable file or directory outside LocalMetadataDir.
4. Trigger client initialization: Cause the application to call New(cfg) or initTUFClients() with the malicious map file, which executes filepath.Join(client.Config.LocalMetadataDir, repoName) without sanitization.
5. Achieve arbitrary file write: go-tuf creates directories and writes root.json (or other metadata) at the traversal-resolved path, potentially overwriting configuration files or planting malicious content to enable further compromise (Github Advisory, Patch Commit).

• File System: Unexpected root.json files created outside the configured LocalMetadataDir cache directory, particularly in parent directories or sensitive locations (e.g., /etc/, application config directories); newly created directories with names matching traversal patterns (e.g., escaped-repo) in unexpected filesystem locations.
• Logs: Application logs showing [CALLSITE_HIT] and [PROOF_MARKER] entries (as referenced in the PoC); errors or unexpected directory creation events logged by the go-tuf process outside the expected cache path.
• Process: The go-tuf process creating or modifying files in directories outside its designated LocalMetadataDir; unexpected file write system calls to paths containing .. components originating from the go-tuf process.

Upgrade github.com/theupdateframework/go-tuf/v2 to version 2.4.1 or later, which enforces strict validation of repoName using a regex pattern (^[a-zA-Z0-9][a-zA-Z0-9._-]*$) that rejects path traversal sequences, absolute paths, and path separators (Patch Commit). If immediate upgrade is not possible, apply the following workarounds: (1) treat TAP 4 map files as trusted configuration only — never fetch from untrusted sources; (2) validate repoName fields before passing map files to go-tuf, rejecting absolute paths, path separators (/, \), and traversal components (., ..); (3) set DisableLocalCache=true to avoid writing metadata to disk; and (4) apply the principle of least privilege to restrict the go-tuf process's filesystem write permissions to the minimum necessary (Github Advisory).

The vulnerability was reported by security researcher Oleh (handle 1seal) via GitHub private reporting and remediated by go-tuf maintainer rdimitrov with review by kommendorkapten. The advisory was published on January 26, 2026, and the patch was merged promptly. Downstream distributions including SUSE, Fedora, Wolfi/Chainguard, and Amazon Linux 2 have issued advisories or updates addressing this CVE, indicating broad ecosystem awareness (Github Advisory).