CVE-2026-71556 is a security flaw in the go-git library, an extensible Git implementation in Go. During worktree operations such as checkout, status, and add, symbolic links are resolved without proper boundary confinement. This allows a remote attacker to craft a malicious Git repository containing symbolic links that, when cloned and operated on, can cause the application to read or write files outside the intended working directory. This can result in information disclosure or arbitrary file modification. Exploitation requires cloning an attacker-controlled repository and performing worktree operations on it. The vulnerability is rated as important by Red Hat and has a CVSS v3.1 base score of 7.1 (high severity). The issue is fixed in go-git versions 5.19.2 and 6.0.0-alpha.5 and later. Red Hat Hardened Images RPMs have been updated accordingly.

An attacker who can supply a malicious Git repository and induce an affected application to clone and perform worktree operations on it may cause arbitrary file reads or writes outside the intended directory. This can lead to information disclosure or modification of files, potentially bypassing security mechanisms. The vulnerability does not require privileges or user interaction beyond cloning and worktree operations. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages for Red Hat Hardened Images that include fixed versions of go-git (5.19.2 and 6.0.0-alpha.5 or later). Users should apply these updates promptly. Until patched, avoid cloning or performing worktree operations on Git repositories from untrusted or attacker-controlled sources. The vendor advisory provides detailed update instructions. No additional mitigations are specified.