CVE-2026-88922: go-getter Privilege Escalation Vulnerability

CVE-2026-88922 Overview

The HashiCorp go-getter library contains a privilege escalation vulnerability in its archive decompression handling. Versions up to and including 1.8.8 and 2.2.3 allow a crafted archive to produce extracted files with elevated permission bits. When a privileged user or process performs the extraction, a local attacker can gain the privileges of the extracting process. The issue is tracked as [CWE-281: Improper Preservation of Permissions] and is fixed in go-getter1.8.9 and 2.2.4.

Critical Impact
A local attacker who can supply an archive to a privileged extraction process may obtain that process's privileges, resulting in local privilege escalation.

Affected Products

HashiCorp go-getter versions up to and including 1.8.8
HashiCorp go-getter versions up to and including 2.2.3
Downstream tools and services that embed vulnerable go-getter releases for archive fetching and extraction

Discovery Timeline

2026-09-15 - CVE-2026-88922 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-88922

Vulnerability Analysis

The go-getter library downloads files and directories from various sources and unpacks archive formats such as zip, tar, and tar.gz. During decompression, the library applies permission bits stored inside archive entries to files written on disk. An attacker who controls archive contents can embed entries whose mode bits include setuid, setgid, world-writable, or other elevated permissions.

When the extracting process runs with higher privileges than the archive supplier, the resulting on-disk files inherit those unsafe permissions. A local actor who can then execute or modify the extracted files gains the privileges of the extracting process. Exploitation requires local access, high attack complexity, low privileges, and user interaction with a malicious archive, but the confidentiality, integrity, and availability impact is high once conditions are met.

Root Cause

The root cause is improper preservation of permissions during decompression. The library trusts the mode bits inside archive entries and writes them to disk without masking dangerous bits such as setuid (04000), setgid (02000), and world-writable (0002). This mapping of [CWE-281] behavior means archive-controlled permissions cross a privilege boundary at extraction time.

Attack Vector

An attacker crafts an archive that contains one or more files with elevated permission bits set in the archive metadata. The attacker then arranges for a privileged workflow, such as an infrastructure automation job, provisioning script, or CI/CD runner that consumes go-getter, to fetch and extract the archive. On extraction, the file is written with attacker-chosen permissions, for example a setuid root binary owned by the privileged user. The attacker then invokes the file as an unprivileged local user to escalate privileges.

No verified public exploit code is available. See the HashiCorp Security Advisory HCSEC-2026-39 for vendor technical details.

Detection Methods for CVE-2026-88922

Indicators of Compromise

Files created by automation, provisioning, or CI/CD processes that carry setuid or setgid bits and are owned by root or another privileged account.
World-writable executables appearing in directories populated by go-getter extraction workflows.
Unexpected new SUID/SGID binaries appearing shortly after a terraform, packer, nomad, or custom tooling run that used go-getter.

Detection Strategies

Inventory build hosts, runners, and orchestrators for binaries that statically link go-getter at versions <= 1.8.8 or <= 2.2.3.
Baseline the set of SUID/SGID files on systems that run privileged extraction workflows and alert on additions using find / -perm -4000 -o -perm -2000.
Correlate archive fetch events from go-getter-based tooling with subsequent filesystem changes to detect anomalous permission bits on extracted content.

Monitoring Recommendations

Enable file integrity monitoring on paths written by automation that uses go-getter, including Terraform module caches and Packer working directories.
Log and review process execution of newly created binaries under privileged service accounts.
Track outbound fetches by go-getter clients and flag archives sourced from untrusted or user-controllable locations.

How to Mitigate CVE-2026-88922

Immediate Actions Required

Upgrade go-getter to version 1.8.9 or 2.2.4 in all applications, tools, and pipelines that import the library.
Rebuild and redeploy downstream binaries that embed go-getter, including internal tooling and vendor products, once fixed versions are available.
Audit systems for SUID/SGID files created by prior extraction runs and remove or reset permissions on any unexpected entries.

Patch Information

HashiCorp fixed CVE-2026-88922 in go-getter1.8.9 and 2.2.4. Details are published in HashiCorp Security Advisory HCSEC-2026-39. Consumers must update their dependency manifests, for example go.mod, and rebuild affected binaries.

Workarounds

Restrict archive sources to trusted, signed, or checksum-verified locations to prevent untrusted permission metadata from reaching extraction.
Run archive extraction as an unprivileged service account and grant only the minimum filesystem privileges needed for the workflow.
Mount extraction target directories with the nosuid option to strip setuid/setgid semantics from files written there.

bash

# Mount extraction workspace with nosuid to neutralize elevated permission bits
mount -o remount,nosuid,nodev /var/lib/extract

# Locate and inspect SUID/SGID files created after suspect extraction runs
find /var/lib/extract -xdev \( -perm -4000 -o -perm -2000 \) -ls

# Pin the fixed go-getter version in a Go module
# go.mod
# require github.com/hashicorp/go-getter v1.8.9