CVE-2026-41506 — go-git Credential leak via cross-host redirect in smart HTTP transport
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following…
Published: 2026-05-08 · CVSS: 4.7 · CVSS 3.1
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7