CVE-2026-39822: os.Root Path Traversal Vulnerability

CVE-2026-39822 Overview

CVE-2026-39822 is a symlink traversal vulnerability in the Go standard library's os.Root API on Unix systems. The flaw allows a file open operation to escape the intended root directory when the final component of a path is a symbolic link and the path ends with a trailing slash. For example, root.Open("symlink/") opens the symlink target even when that target points outside the root. The issue is tracked as GO-2026-4970 and is classified under [CWE-61] (UNIX Symbolic Link Following). Successful exploitation lets a local actor read or modify files outside the sandboxed root, breaking a core security guarantee of the os.Root API.

Critical Impact
A local attacker who controls path inputs or filesystem contents can escape the os.Root sandbox and access files anywhere on the system with the privileges of the Go process.

Affected Products

Go standard library os package on Unix systems
Applications using the os.Root API for filesystem sandboxing
Go toolchain versions prior to the fix referenced in Go change 797880

Discovery Timeline

2026-07-08 - CVE-2026-39822 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-39822

Vulnerability Analysis

The os.Root type in Go provides a sandboxed filesystem view intended to prevent path resolution from escaping a designated directory. Its guarantee is that operations like Open, Create, and Stat cannot follow symbolic links to targets outside the root. On Unix, this guarantee breaks when the final path component is a symlink and the path ends with a trailing slash. In that case the sandbox check does not correctly treat the symlink as the final resolved component, and the underlying openat sequence follows the symlink to its true target. See the Go issue report and the Go vulnerability advisory for the upstream analysis.

Root Cause

The root cause is inconsistent handling of trailing slashes during path resolution inside os.Root. Trailing slashes on Unix cause the kernel to resolve the final component as a directory, which requires following any symlink at that position. The sandbox logic did not apply its symlink-escape check to this specific path shape, so a symlink whose target lies outside the root is followed without validation.

Attack Vector

Exploitation requires local access and the ability to influence either the path passed to os.Root methods or the contents of the sandboxed directory. An attacker who can create a symbolic link inside the root pointing to an external path — for example /etc or another user's home directory — can then trigger the vulnerable code path by opening that name with a trailing slash. The result is that the Go process opens the external target under its own privileges, enabling information disclosure, tampering, or, when the process runs as a privileged user, integrity and availability impact against files outside the intended sandbox. Technical details are described in the Go change log and the golang-announce message.

Detection Methods for CVE-2026-39822

Indicators of Compromise

Symbolic links inside directories used as os.Root sandboxes whose targets resolve outside the intended root.
File access events from Go binaries opening paths that end with / and resolve to sensitive locations such as /etc, /root, or other users' home directories.
Unexpected reads or writes to files outside a service's working directory performed by a Go-based daemon.

Detection Strategies

Inventory Go binaries in the environment and identify those that use the os.Root API for sandboxing user-controlled paths.
Audit application code and dependencies for calls to Root.Open, Root.Create, and related methods that accept externally influenced path strings.
Use filesystem auditing (auditd, eBPF-based file access monitors) to flag symlink creation inside sandboxed directories owned by service accounts.

Monitoring Recommendations

Monitor openat2 and openat syscalls from Go processes for resolutions that cross expected directory boundaries.
Alert on newly created symlinks within upload, tenant, or plugin directories used by Go services.
Correlate process-level file access telemetry with the process image path to isolate Go binaries operating outside their intended scope.

How to Mitigate CVE-2026-39822

Immediate Actions Required

Update the Go toolchain to a version that includes the fix from Go change 797880 and rebuild affected applications.
Rebuild and redeploy any first-party or third-party Go binaries that rely on os.Root for sandboxing.
Restrict local access to hosts running vulnerable Go services until patched builds are deployed.

Patch Information

The fix is available through the Go project. Refer to the Go vulnerability advisory GO-2026-4970 and the golang-announce release notice for the specific Go release versions containing the patch. After upgrading, run go version on build hosts and govulncheck ./... against application modules to confirm remediation.

Workarounds

Normalize incoming paths and reject any path ending in / before passing it to os.Root methods.
Deny creation of symbolic links inside directories that back an os.Root sandbox, enforced via filesystem permissions or mount options such as nosymfollow where supported.
Run Go services under least-privilege accounts so that a sandbox escape cannot reach sensitive files outside the service's own data.

bash

# Confirm the Go toolchain version includes the fix
go version

# Scan Go modules for known vulnerabilities including GO-2026-4970
govulncheck ./...