CVE-2026-41506: 
Packer vulnerability analysis and mitigation

CVE-2026-41506 is a credential leak vulnerability in go-git, an extensible Git implementation library written in pure Go, classified as "Credential leak via cross-host redirect in smart HTTP transport." It affects all versions of go-git up to and including v5.17.2 (v5 branch) and v6.0.0-alpha.1 (v6 branch). The vulnerability was published on May 8, 2026, with patches released on April 16, 2026 (v5.18.0 and v6.0.0-alpha.2). It carries a CVSS v3.1 base score of 7.4 (High) per NVD, or 4.7 (Moderate) per the GitHub Security Advisory (GitHub Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): go-git's smart-HTTP transport does not strip or validate authentication credentials when following HTTP redirects to a different host. When a remote repository's /info/refs endpoint responds with a redirect to a different host, go-git updates its session endpoint to the redirected location and reuses the original Authorization header for all subsequent requests. This means an attacker who controls or can influence the redirect target (e.g., via a malicious or misconfigured Git server, or a man-in-the-middle on an unencrypted HTTP connection) can capture the victim's credentials. Exploitation requires user interaction — a user or automated process must initiate a git clone or fetch operation against a server that issues a cross-host redirect (GitHub Advisory).

Successful exploitation results in the disclosure of HTTP authentication credentials (e.g., personal access tokens, passwords embedded in Authorization headers) to an unintended third-party host. The confidentiality impact is high — captured credentials can be reused by an attacker to access the victim's Git repositories or other services protected by the same credentials, potentially enabling unauthorized code access, data exfiltration, or supply chain compromise. Availability and integrity are not directly impacted. Clients interacting exclusively with trusted, well-known remotes (e.g., GitHub, GitLab) over HTTPS are not at risk; the vulnerability primarily affects users connecting to untrusted or misconfigured Git servers, or those using unencrypted HTTP (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.047% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control or influence a redirect target encountered during a smart-HTTP clone or fetch, which limits opportunistic exploitation but remains a realistic threat in supply chain or targeted attack scenarios (GitHub Advisory, Feedly).

1. Set up a malicious Git server: The attacker configures an HTTP Git server that, upon receiving a smart-HTTP /info/refs?service=git-upload-pack request, responds with an HTTP redirect (e.g., 301 or 302) pointing to an attacker-controlled host on a different domain.
2. Lure the victim: The attacker convinces a user or automated CI/CD pipeline using go-git (versions ≤ 5.17.2 or ≤ 6.0.0-alpha.1) to clone or fetch from the malicious server URL (e.g., via a phishing link, a compromised dependency, or a misconfigured remote).
3. Credential capture: When go-git follows the cross-host redirect, it reuses the original Authorization header (containing the victim's credentials) in the request to the attacker-controlled host. The attacker's server logs or captures this header.
4. Credential reuse: The attacker extracts the captured credentials (e.g., a personal access token or Basic Auth password) and uses them to authenticate to the victim's actual Git hosting service (GitHub, GitLab, etc.), gaining unauthorized access to repositories or other protected resources (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from a go-git client to an unexpected or unknown host immediately following a redirect from a known Git server; Authorization headers observed in traffic to non-original Git server hosts.
• Logs: Application or HTTP access logs showing a redirect chain from the intended Git remote to an unfamiliar domain during clone or fetch operations; HTTP 301/302 responses from Git servers pointing to external hosts.
• Process/Behavior: Unexpected authentication failures or account lockouts on Git hosting services shortly after a clone/fetch operation; unauthorized access events in Git hosting audit logs using valid credentials from an unfamiliar IP address.

Users should upgrade go-git to v5.18.0 (v5 branch) or v6.0.0-alpha.2 (v6 branch), which add configurable followRedirects policy support. The patched versions default to initial redirect behavior (matching upstream Git), preventing credentials from being forwarded to a different host. As a workaround prior to upgrading, avoid cloning or fetching from untrusted or unknown Git servers, and always use HTTPS rather than plain HTTP. Applications can also be reviewed to ensure they do not pass credentials to go-git when interacting with potentially untrusted remotes (GitHub Advisory, v5.18.0 Release, v6.0.0-alpha.2 Release).

The vulnerability was independently reported by three separate researchers — @celinke97, @N0zoM1z0, and @AyushParkara — who disclosed it privately to the go-git project, demonstrating active community engagement with the library's security. The go-git maintainer @pjbgf published the advisory and coordinated the patch release. OpenSUSE and SUSE Linux issued security announcements addressing the vulnerability in their package ecosystems, and Tenable published Nessus detection plugins (IDs 313456 and 315033) (GitHub Advisory, OpenSUSE Announce).