CVE-2026-24686
Medium · 4.7CVSS
4.7
EPSS
0.2%
Published
Jan 27, 2026
CISA due date
—
The record
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/theupdateframework/go-tuf/v2 | 0 | 2.4.1 |
| Chainguard | buildkitd | 0 | 0.27.1-r3 |
| Chainguard | buildkitd-fips | 0 | 0.27.1-r0 |
| Chainguard | cg | 0 | 0.2.202-r0 |
| Chainguard | chainctl | 0 | 0.2.206-r0 |
| Chainguard | cosign | 0 | 3.0.4-r2 |
| Chainguard | cosign-fips | 0 | 3.0.4-r3 |
| Chainguard | crossplane-1.20 | 0 | 1.20.5-r1 |
| Chainguard | crossplane-2.0 | 0 | 2.0.7-r0 |
| Chainguard | crossplane-2.1 | 0 | 2.1.3-r4 |
| Chainguard | crossplane-2.1 | 0 | 2.1.4-r0 |
| Chainguard | crossplane-fips-1.20 | 0 | 1.20.5-r4 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.7-r0 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.4-r0 |
| Chainguard | dockerd-29 | 0 | 29.2.1-r0 |
| Chainguard | falcoctl | 0 | 0.12.2-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.1-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.2-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r6 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r6 |
| Chainguard | gh | 0 | 2.86.0-r1 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | goreleaser | 0 | 2.13.3-r4 |
| Chainguard | image-factory | 0 | 0.9.0-r5 |
| Chainguard | image-factory | 0 | 1.0.2-r0 |
| Chainguard | image-factory-fips | 0 | 1.0.2-r0 |
| Chainguard | ko | 0 | 0.18.1-r2 |
| Chainguard | ko-fips | 0 | 0.18.1-r2 |
| Chainguard | kubescape | 0 | 4.0.0-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r35 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r34 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r5 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20260130-r0 |
| Chainguard | policy-controller | 0 | 0.14.0-r0 |
| Chainguard | policy-controller | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-fips | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester | 0 | 0.14.0-r0 |
| Chainguard | policy-controller-tester | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester-fips | 0 | 0.15.1-r0 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0 | 0.7.31-r6 |
| Chainguard | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Chainguard | skaffold | 0 | 2.17.1-r5 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r2 |
| Chainguard | spire-agent | 0 | 1.14.1-r4 |
| Chainguard | spire-agent-fips | 0 | 1.14.1-r3 |
| Chainguard | tekton-chains | 0 | 0.26.0-r6 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r6 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Chainguard | teleport-operator-fips-18 | 0 | 18.6.4-r0 |
| Chainguard | tflint | 0 | 0.60.0-r6 |
| Chainguard | tflint-fips | 0 | 0.61.0-r0 |
| Chainguard | tkn | 0 | 0.43.0-r6 |
| Chainguard | tkn-fips | 0 | 0.43.0-r4 |
| Chainguard | trivy | 0 | 0.69.0-r0 |
| Chainguard | trivy-fips | 0 | 0.69.0-r0 |
| Chainguard | trivy-operator | 0 | 0.29.0-r9 |
| Chainguard | trivy-operator-fips | 0 | 0.29.0-r9 |
| Chainguard | vexctl | 0 | 0.4.1-r10 |
| Chainguard | witness | 0 | 0.10.2-r3 |
| Chainguard | zarf | 0 | 0.70.1-r4 |
| Chainguard | zot | 0 | 2.1.14-r0 |
| Wolfi | buildkitd | 0 | 0.27.1-r3 |
| Wolfi | cosign | 0 | 3.0.4-r2 |
| Wolfi | cosign-fips | 0 | 3.0.4-r3 |
| Wolfi | crossplane-2.1 | 0 | 2.1.3-r4 |
| Wolfi | crossplane-2.1 | 0 | 2.1.4-r0 |
| Wolfi | dockerd-29 | 0 | 29.2.1-r0 |
| Wolfi | falcoctl | 0 | 0.12.2-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r6 |
| Wolfi | gh | 0 | 2.86.0-r1 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | goreleaser | 0 | 2.13.3-r4 |
| Wolfi | ko | 0 | 0.18.1-r2 |
| Wolfi | ko-fips | 0 | 0.18.1-r2 |
| Wolfi | kubescape | 0 | 4.0.0-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r0 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r35 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Wolfi | policy-controller | 0 | 0.14.0-r0 |
| Wolfi | policy-controller | 0 | 0.15.1-r0 |
| Wolfi | policy-controller-tester | 0 | 0.14.0-r0 |
| Wolfi | policy-controller-tester | 0 | 0.15.1-r0 |
| Wolfi | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Wolfi | skaffold | 0 | 2.17.1-r5 |
| Wolfi | spire-agent | 0 | 1.14.1-r4 |
| Wolfi | tekton-chains | 0 | 0.26.0-r6 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Wolfi | tflint | 0 | 0.60.0-r6 |
| Wolfi | tkn | 0 | 0.43.0-r6 |
| Wolfi | trivy | 0 | 0.69.0-r0 |
| Wolfi | trivy-operator | 0 | 0.29.0-r9 |
| Wolfi | vexctl | 0 | 0.4.1-r10 |
| Wolfi | witness | 0 | 0.10.2-r3 |
| Wolfi | zarf | 0 | 0.70.1-r4 |
| Wolfi | zot | 0 | 2.1.14-r0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Tumbleweed | kyverno | 0 | 1.18.0-1.1 |
Related vulnerabilities
- CVE-2026-23991 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2024-47534 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects buildkitd
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects buildkitd
- CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects buildkitd
- CVE-2026-24137 sigstore framework is a common go library shared across sigstore services and clients. Also affects buildkitd
- CVE-2026-24117 Rekor is a software supply chain transparency log. Also affects buildkitd