CVE-2026-39822

Root escape via symlink plus trailing slash in os

CVE-2026-39822 is fixed in 65 products on 2 platforms, first by RHSA-2026:49702, released May 27, 2026. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.2
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0023
14th percentile

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Go Programming Language 1.27.3 Go Programming Language 1.27.3 Oct 19, 2026
Linux
amazon-cloudwatch-agent · amzn 2023 1.300069.1-1.amzn2023 ALAS2023-2026-2025 Aug 3, 2026
amazon-ecr-credential-helper · amzn 2023 0.12.0-4.amzn2023 ALAS2023-2026-3180 Nov 7, 2026
buildah · RHEL 10 1.43.1-4.el10_2 RHSA-2026:38494 Jul 13, 2026
buildah · RHEL 9 2:1.43.1-4.el9_8 RHSA-2026:38493 Jul 13, 2026
buildah · almalinux 10 2:1.43.1-4.el10_2 ALSA-2026:38494 Jul 13, 2026
buildah · almalinux 9 2:1.43.1-4.el9_8 ALSA-2026:38493 Jul 13, 2026
buildah · ol 10 2:1.43.1-4.0.1.el10_2 ELSA-2026-38494 Jul 16, 2026
buildah · ol 9 2:1.43.1-4.0.1.el9_8 ELSA-2026-38493 Jul 14, 2026
buildah · rocky 10 2:1.43.1-4.el10_2 RLSA-2026:38494 Jul 14, 2026
buildah · rocky 9 2:1.43.1-4.el9_8 RLSA-2026:38493 Jul 14, 2026
buildah-tests · RHEL 9 2:1.43.1-4.el9_8 RHSA-2026:38493 Jul 13, 2026
buildah-tests · almalinux 10 2:1.43.1-4.el10_2 ALSA-2026:38494 Jul 13, 2026
buildah-tests · almalinux 9 2:1.43.1-4.el9_8 ALSA-2026:38493 Jul 13, 2026
buildah-tests · ol 10 2:1.43.1-4.0.1.el10_2 ELSA-2026-38494 Jul 16, 2026
buildah-tests · ol 9 2:1.43.1-4.0.1.el9_8 ELSA-2026-38493 Jul 14, 2026
compat-golang-github-cpuguy83-md2man-2-devel · amzn 2023 2.0.2-24.amzn2023.0.9 ALAS2023-2026-1989 Jul 20, 2026
containerd · amzn 2023 2.2.7-1.amzn2023.0.1 ALAS2023-2026-2131 Sep 9, 2026
containerd-debuginfo · amzn 2023 2.2.7-1.amzn2023.0.1 ALAS2023-2026-2131 Sep 9, 2026
containerd-debugsource · amzn 2023 2.2.7-1.amzn2023.0.1 ALAS2023-2026-2131 Sep 9, 2026
containerd-stress · amzn 2023 2.2.7-1.amzn2023.0.1 ALAS2023-2026-2131 Sep 9, 2026
containerd-stress-debuginfo · amzn 2023 2.2.7-1.amzn2023.0.1 ALAS2023-2026-2131 Sep 9, 2026
credentials-fetcher · amzn 2023 2.0.3-1.amzn2023.0.2 ALAS2023-2026-1975 Jul 20, 2026
delve · RHEL 8 0:1.26.1-1.module+el8.10.0+24516+40554724 RHSA-2026:38995 Jul 14, 2026
delve · almalinux 8 1.26.1-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
delve · ol 8 0:1.26.1-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
delve · rocky 8 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8 RLSA-2026:38995 Jul 15, 2026
docker · amzn 2023 25.0.16-1.amzn2023.0.5 ALAS2023-2026-3205 Nov 7, 2026
docker-debuginfo · amzn 2023 25.0.16-1.amzn2023.0.5 ALAS2023-2026-3205 Nov 7, 2026
docker-debugsource · amzn 2023 25.0.16-1.amzn2023.0.5 ALAS2023-2026-3205 Nov 7, 2026
go-toolset · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
go-toolset · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
go-toolset · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
go-toolset · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
go-toolset · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
go-toolset · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
go-toolset · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
go-toolset · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
go1.25 · opensuse-leap 16.0 1.25.12-160000.1.1 OPENSUSE-SU-2026:21324-1 Jul 13, 2026
go1.25 · sles 15.6 1.25.12-150000.1.44.1 SUSE-SU-2026:2817-1 Jul 9, 2026
go1.25 · sles 15.7 1.25.12-150000.1.44.1 SUSE-SU-2026:2817-1 Jul 9, 2026
go1.25 · sles 16.0 1.25.12-160000.1.1 SUSE-SU-2026:22643-1 Jul 13, 2026
go1.25-openssl · opensuse-leap 16.0 1.25.12-160000.1.1 OPENSUSE-SU-2026:21319-1 Jul 13, 2026
go1.25-openssl · sles 15.6 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1 Jul 21, 2026
go1.25-openssl · sles 15.7 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1 Jul 21, 2026
go1.25-openssl · sles 16.0 1.25.12-160000.1.1 SUSE-SU-2026:22638-1 Jul 13, 2026
go1.26 · opensuse-leap 16.0 1.26.5-160000.1.1 OPENSUSE-SU-2026:21341-1 Jul 14, 2026
go1.26 · sles 15.6 1.26.5-150000.1.18.1 SUSE-SU-2026:2818-1 Jul 9, 2026
go1.26 · sles 15.7 1.26.5-150000.1.18.1 SUSE-SU-2026:2818-1 Jul 9, 2026
go1.26 · sles 16.0 1.26.5-160000.1.1 SUSE-SU-2026:22656-1 Jul 14, 2026
go1.26-openssl · opensuse-leap 16.0 1.26.5-160000.1.1 OPENSUSE-SU-2026:21321-1 Jul 13, 2026
go1.26-openssl · sles 15.6 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1 Jul 17, 2026
go1.26-openssl · sles 15.7 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1 Jul 17, 2026
go1.26-openssl · sles 16.0 1.26.5-160000.1.1 SUSE-SU-2026:22641-1 Jul 13, 2026
golang · RHEL 10 1.26.5-1.el10_0 RHSA-2026:49702 May 27, 2026
golang · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang · rocky 10 0:1.26.5-1.el10_2 RLSA-2026:37436 Jul 13, 2026
golang · rocky 8 0:1.26.5-1.module+el8.10.0+40244+e7cb3ff8 RLSA-2026:38995 Jul 15, 2026
golang · rocky 9 0:1.26.5-1.el9_8 RLSA-2026:37435 Jul 13, 2026
golang-1.26 · Debian 14 1.26.5-1 DEBIAN-CVE-2026-39822 Jul 10, 2026
golang-1.27 · Debian 14 1.27~rc2-1 DEBIAN-CVE-2026-39822 Jul 10, 2026
golang-bin · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-bin · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-bin · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-bin · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-bin · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-bin · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-bin · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-bin · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-bin · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang-docs · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-docs · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-docs · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-docs · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-docs · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-docs · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-docs · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-docs · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-docs · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang-github-burntsushi-toml · amzn 2023 1.5.0-1.amzn2023.0.3 ALAS2023-2026-1978 Jul 20, 2026
golang-github-burntsushi-toml-debuginfo · amzn 2023 1.5.0-1.amzn2023.0.3 ALAS2023-2026-1978 Jul 20, 2026
golang-github-burntsushi-toml-debugsource · amzn 2023 1.5.0-1.amzn2023.0.3 ALAS2023-2026-1978 Jul 20, 2026
golang-github-burntsushi-toml-devel · amzn 2023 1.5.0-1.amzn2023.0.3 ALAS2023-2026-1978 Jul 20, 2026
golang-github-burntsushi-toml-test · amzn 2023 0.2.0-8.amzn2023.0.5 ALAS2023-2026-1977 Jul 20, 2026
golang-github-burntsushi-toml-test-debuginfo · amzn 2023 0.2.0-8.amzn2023.0.5 ALAS2023-2026-1977 Jul 20, 2026
golang-github-burntsushi-toml-test-debugsource · amzn 2023 0.2.0-8.amzn2023.0.5 ALAS2023-2026-1977 Jul 20, 2026
golang-github-burntsushi-toml-test-devel · amzn 2023 0.2.0-8.amzn2023.0.5 ALAS2023-2026-1977 Jul 20, 2026
golang-github-cpuguy83-md2man · amzn 2023 2.0.2-24.amzn2023.0.9 ALAS2023-2026-1989 Jul 20, 2026
golang-github-cpuguy83-md2man-debuginfo · amzn 2023 2.0.2-24.amzn2023.0.9 ALAS2023-2026-1989 Jul 20, 2026
golang-github-cpuguy83-md2man-debugsource · amzn 2023 2.0.2-24.amzn2023.0.9 ALAS2023-2026-1989 Jul 20, 2026
golang-github-cpuguy83-md2man-devel · amzn 2023 2.0.2-24.amzn2023.0.9 ALAS2023-2026-1989 Jul 20, 2026
golang-misc · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-misc · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-misc · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-misc · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-misc · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-misc · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-misc · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-misc · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-misc · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang-race · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-race · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-race · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-race · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-race · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-race · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-race · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-race · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang-shared · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-src · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-src · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-src · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-src · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-src · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-src · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-src · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-src · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-src · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golang-tests · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-tests · RHEL 9 0:1.26.5-1.el9_8 RHSA-2026:37435 Jul 11, 2026
golang-tests · almalinux 10 1.26.5-1.el10_2.alma.1 ALSA-2026:37436 Jul 9, 2026
golang-tests · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-tests · almalinux 9 1.26.5-1.el9_8 ALSA-2026:37435 Jul 9, 2026
golang-tests · amzn 2023 1.25.12-1.amzn2023.0.1 ALAS2023-2026-1979 Jul 20, 2026
golang-tests · ol 10 0:1.26.5-1.0.1.el10_2 ELSA-2026-37436 Jul 16, 2026
golang-tests · ol 8 0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3 ELSA-2026-38995 Jul 14, 2026
golang-tests · ol 9 0:1.26.5-1.0.1.el9_8 ELSA-2026-37435 Jul 10, 2026
golist · amzn 2023 0.10.4-12.amzn2023.0.11 ALAS2023-2026-1976 Jul 20, 2026
golist-debuginfo · amzn 2023 0.10.4-12.amzn2023.0.11 ALAS2023-2026-1976 Jul 20, 2026
golist-debugsource · amzn 2023 0.10.4-12.amzn2023.0.11 ALAS2023-2026-1976 Jul 20, 2026
govulncheck-vulndb · opensuse-leap 16.0 0.0.20260723T184607-160000.1.1 OPENSUSE-SU-2026:21483-1 Jul 30, 2026
nerdctl · amzn 2023 2.3.5-1.amzn2023.0.1 ALAS2023-2026-2129 Aug 31, 2026
oci-add-hooks · amzn 2023 0-0.1.20200504git268e3bb.amzn2023.0.12 ALAS2023-2026-3206 Nov 7, 2026
oci-add-hooks-debuginfo · amzn 2023 0-0.1.20200504git268e3bb.amzn2023.0.12 ALAS2023-2026-3206 Nov 7, 2026
oci-add-hooks-debugsource · amzn 2023 0-0.1.20200504git268e3bb.amzn2023.0.12 ALAS2023-2026-3206 Nov 7, 2026
openshift · RHEL 10 4.21.0-202609022229.p2.g93afd70.assembly.stream.el10 RHSA-2026:66350 Aug 13, 2026
podman · RHEL 9 6:5.8.2-5.el9_8 RHSA-2026:38878 Jul 14, 2026
podman · almalinux 10 7:5.8.2-5.el10_2.alma.1 ALSA-2026:38495 Jul 13, 2026
podman · almalinux 9 6:5.8.2-5.el9_8 ALSA-2026:38878 Jul 13, 2026
podman · ol 10 7:5.8.2-5.0.1.el10_2 ELSA-2026-38495 Jul 16, 2026
podman · ol 9 6:5.8.2-5.0.1.el9_8 ELSA-2026-38878 Jul 14, 2026
podman · rocky 10 7:5.8.2-5.el10_2 RLSA-2026:38495 Jul 14, 2026
podman · rocky 9 6:5.8.2-5.el9_8 RLSA-2026:38878 Jul 14, 2026
podman-docker · RHEL 9 6:5.8.2-5.el9_8 RHSA-2026:38878 Jul 14, 2026
podman-docker · almalinux 10 7:5.8.2-5.el10_2.alma.1 ALSA-2026:38495 Jul 13, 2026
podman-docker · almalinux 9 6:5.8.2-5.el9_8 ALSA-2026:38878 Jul 13, 2026
podman-docker · ol 10 7:5.8.2-5.0.1.el10_2 ELSA-2026-38495 Jul 16, 2026
podman-docker · ol 9 6:5.8.2-5.0.1.el9_8 ELSA-2026-38878 Jul 14, 2026
podman-plugins · RHEL 9 6:5.8.2-5.el9_8 RHSA-2026:38878 Jul 14, 2026
podman-plugins · almalinux 9 6:5.8.2-5.el9_8 ALSA-2026:38878 Jul 13, 2026
podman-plugins · ol 9 6:5.8.2-5.0.1.el9_8 ELSA-2026-38878 Jul 14, 2026
podman-remote · RHEL 9 6:5.8.2-5.el9_8 RHSA-2026:38878 Jul 14, 2026
podman-remote · almalinux 10 7:5.8.2-5.el10_2.alma.1 ALSA-2026:38495 Jul 13, 2026
podman-remote · almalinux 9 6:5.8.2-5.el9_8 ALSA-2026:38878 Jul 13, 2026
podman-remote · ol 10 7:5.8.2-5.0.1.el10_2 ELSA-2026-38495 Jul 16, 2026
podman-remote · ol 9 6:5.8.2-5.0.1.el9_8 ELSA-2026-38878 Jul 14, 2026
podman-tests · RHEL 9 6:5.8.2-5.el9_8 RHSA-2026:38878 Jul 14, 2026
podman-tests · almalinux 10 7:5.8.2-5.el10_2.alma.1 ALSA-2026:38495 Jul 13, 2026
podman-tests · almalinux 9 6:5.8.2-5.el9_8 ALSA-2026:38878 Jul 13, 2026
podman-tests · ol 10 7:5.8.2-5.0.1.el10_2 ELSA-2026-38495 Jul 16, 2026
podman-tests · ol 9 6:5.8.2-5.0.1.el9_8 ELSA-2026-38878 Jul 14, 2026
rclone · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
rclone-debuginfo · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
rclone-debugsource · amzn 2023 1.75.1-1.amzn2023 ALAS2023-2026-3129 Sep 28, 2026
runc · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runc-debuginfo · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runc-debugsource · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runfinch-finch · amzn 2023 1.17.2-1.amzn2023.0.3 ALAS2023-2026-2023 Aug 3, 2026
soci-snapshotter · amzn 2023 0.16.0-1.amzn2023.0.1 ALAS2023-2026-3153 Nov 7, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.