CVE-2026-56857
published 2026-10-08CVE-2026-56857: On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.55%
45.9th percentile
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| debian | qpid-proton | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | internal_syscall_windows | < 1.26.9 | 1.26.9 |
| go_standard_library | internal_syscall_windows | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| go_standard_library | os | < 1.26.9 | 1.26.9 |
| go_standard_library | os | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| helm | helm | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
os: golang: golang: Directory traversal via Windows junction handling
vendor_redhat·2026-10-08·CVSS 9.8
CVE-2026-56857 [CRITICAL] CWE-59 os: golang: golang: Directory traversal via Windows junction handling
os: golang: golang: Directory traversal via Windows junction handling
A flaw was found in the Go standard library's file system operations on Windows. Scoped directory operations fail to properly restrict directory creation when processing Windows junction points (links redirecting to other folder locations) that point outside the designated root directory. An attacker can exploit this weakness to create directories outside the restricted boundary, bypassing intended directory confinement controls.
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines-client (OpenShift Pipelines) - Fix deferred
Package: kn-workflow-plugin (OpenShift Serverless) - Fix deferred
Package: openshift-serverless-clients (OpenShift Serverless) - Fix deferre
VulDB
Google Go standard library up to 1.26.8/1.27.1 os/internal/syscall/windows Root.Mkdir/Root.MkdirAll mount point (EUVD-2026-95420)
vuldb·2026-10-09·CVSS 9.8
CVE-2026-56857 [CRITICAL] Google Go standard library up to 1.26.8/1.27.1 os/internal/syscall/windows Root.Mkdir/Root.MkdirAll mount point (EUVD-2026-95420)
A vulnerability, which was classified as critical, has been found in Google Go standard library up to 1.26.8/1.27.1. Affected is the function Root.Mkdir/Root.MkdirAll of the component os/internal/syscall/windows. Performing a manipulation results in insecure operation on windows junction / mount point.
This vulnerability is cataloged as CVE-2026-56857. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located out
ghsa_unreviewed·2026-10-09
CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located out
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
No detection rules found.
No public exploits indexed.
2026-10-08
Published