Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-56857 BIT-golang-2026-56857EUVD-2026-95420GHSA-c3q7-m35p-9qq7GO-2026-6604

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Published Oct 8, 2026 · Updated Oct 9, 2026 · Assigned by Go

Vendor: Go standard library Product: internal/syscall/windows Product: os Package: aactl Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cni-plugins-all Package: docker Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: external-dns-0.21 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: go Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.20 Package: golang-1.21 Package: golang-1.23 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gpu-feature-discovery Package: ingress-nginx-controller-1.15 Package: ingress-nginx-custom-error-pages-1.15 Package: k3d Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-webhook-certgen-1.15 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: mps-control-daemon Package: nvidia-device-plugin Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: stdlib Platform: Windows Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Affected products

VendorProductAffectedFixed
Go standard library os < 1.26.9, 1.27.0-0 – < 1.27.2 1.26.9
Go standard library internal/syscall/windows < 1.26.9, 1.27.0-0 – < 1.27.2 1.26.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-1.26 +1 No fix yet —
Ubuntu 26.04 LTS golang-1.23 +3 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +4 No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +1 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.16 +1 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.18 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP7 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP7 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES for SAP 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLES for SAP 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES for SAP 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLE HPC 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLE HPC 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.26 1.26.9-1.1 openSUSE-SU-2026:12093-1
openSUSE Tumbleweed go1.27 1.27.2-1.1 openSUSE-SU-2026:12101-1
openSUSE Tumbleweed rclone 1.75.2-1.1 openSUSE-SU-2026:12112-1
openSUSE Tumbleweed tempo-cli 3.1.1-1.1 openSUSE-SU-2026:12351-1
openSUSE Leap 16.0 go1.26 1.26.9-160000.1.1 openSUSE-SU-2026:22095-1
openSUSE Leap 16.0 go1.27 1.27.2-160000.1.1 openSUSE-SU-2026:22093-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 29.9.0-r0 —
Alpine v3.24 go 1.26.9-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r79 —
Wolfi rolling cert-manager-1.20 +4 1.20.4-r2 —
Wolfi rolling cilium-1.19 +4 1.19.8-r3 —
Wolfi rolling cni-plugins-all 1.9.1-r16 —
Wolfi rolling dogstatsd-7.78 7.78.4-r23 —
Wolfi rolling external-dns-0.21 0.21.0-r27 —
Wolfi rolling falco-no-driver 0.45.0-r4 —
Wolfi rolling flux-2.7 2.7.5-r41 —
Wolfi rolling flux-2.8 2.8.8-r24 —
Wolfi rolling ingress-nginx-controller-1.15 1.15.10-r7 —
Wolfi rolling k3d 5.9.0-r14 —
Wolfi rolling kube-webhook-certgen-1.15 +1 1.15.10-r8 —
Wolfi rolling kubeadm-1.35 +7 1.35.9-r1 —
Wolfi rolling kubeadm-1.36 +7 1.36.5-r1 —
Wolfi rolling kubectl-1.32 +1 No fix yet —
Wolfi rolling loki-3.6 +3 3.6.17-r4 —
Wolfi rolling mps-control-daemon +2 0.20.1-r1 —
Wolfi rolling spire-agent +2 1.15.3-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.26.9 · >= 1.27.0-0, < 1.27.2 1.26.9, 1.27.2 GO-2026-6604

Advisories 13

References