Skip to content
OpenAdvisories
Medium RHSA-2026:68281 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 22, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 trivy 0:0.74.0-0.3.hum1

Vulnerabilities 2

  • Medium 6.7
    CVE-2026-88922

    Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

    The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is…

    HashiCorp Shared library kubescape zarf Debian Ubuntu Azure Linux Wolfi
  • Medium 6.3
    CVE-2026-71557 Public exploit

    go-git: Malicious reference names may modify files outside the reference storage

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference …

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-88922
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-71557
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68281.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2512557
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-71557
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-71557
  • article
    https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7
  • article
    https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36
  • article
    https://github.com/go-git/go-git/pull/2247
  • article
    https://github.com/go-git/go-git/pull/2254
  • article
    https://github.com/go-git/go-git/releases/tag/v5.19.2
  • article
    https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5
  • article
    https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2534192
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-88922
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-88922
  • article
    https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752