The vulnerability CVE-2026-71556 affects the go-git library used in Red Hat Hardened Images RPMs, specifically the trivy package versions 0.74.0-0.2.hum1 for aarch64 and x86_64 architectures. The flaw arises because worktree operations resolve symbolic links without confinement to the working directory boundary. An attacker can craft a malicious Git repository containing symlinks that, when cloned and operated on, allow reading or writing files outside the repository directory. This can lead to information disclosure or arbitrary file modification. Exploitation requires the victim to clone and perform worktree operations on an attacker-controlled repository. Red Hat has issued a security advisory and updated packages to fix this issue.

The vulnerability allows a remote attacker to cause arbitrary file read or write operations outside the intended working directory by exploiting symbolic link resolution in go-git worktree operations. This can result in information disclosure or modification of files, potentially bypassing security mechanisms. The impact is rated as Important by Red Hat, with high integrity impact and low availability impact. Exploitation requires user interaction to clone and operate on a malicious repository.

Red Hat has released updated trivy RPMs (version 0.74.0-0.2.hum1) that include the fix for CVE-2026-71556. Users should apply these updates to remediate the vulnerability. Until updated packages are applied, avoid cloning or performing worktree operations (checkout, status, add) on Git repositories from untrusted or attacker-controlled sources. The issue is resolved in go-git versions 5.19.2 and 6.0.0-alpha.5 or later.