CVE-2026-39822: Go os.Root Symlink Escape on Unix Systems

Technical summary

The vulnerability exists in Go's os.Root implementation on Unix platforms. The flaw occurs during path resolution when the final component of a path is a symbolic link and the path string terminates with a '/' character. Under these conditions, the symlink traversal protection fails, and the file operation proceeds to open the target of the symlink rather than treating it as out-of-bounds. This is a classic symlink-race and boundary-escape issue (CWE-61: Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 vector reflects local access requirements (AV:L), but with low complexity and no user interaction needed, combined with high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Business impact

Applications and services using Go's os.Root for sandboxing or file isolation—particularly multi-tenant systems, containerized workloads, or privilege-separated daemons—face a serious containment breach. A local user can escape the intended directory boundary to access, modify, or destroy sensitive files belonging to other users or the application itself. In cloud or shared-hosting environments, this could lead to cross-tenant data exposure or denial of service. Organizations relying on os.Root for security boundaries must treat this as a critical isolation failure until patched.

Affected systems

Go programming language runtime on Unix-based systems (Linux, macOS, BSD, etc.) is affected. Any application built with a vulnerable version of Go and using os.Root for filesystem sandboxing or access control is at risk. Windows systems are not affected due to differences in symlink handling. The vulnerability impacts both Go standard library users and third-party applications that depend on os.Root for security enforcement.

Exploitability

Exploitation requires local system access and user-level privileges—an unprivileged user can trigger the vulnerability without administrative rights or user interaction. An attacker needs only to craft a path string ending in '/' that references a symlink pointing outside the intended root. The low complexity and deterministic nature of the flaw make it highly exploitable in shared-system or multi-tenant contexts. No network access, authentication bypass, or complex race conditions are required.

Remediation

Apply a patched version of Go that fixes symlink validation in os.Root path resolution. Verify the patch version against the official Go security advisory and release notes. Until patching is possible, restrict local user access to systems relying on os.Root for sensitive file isolation, or move to alternative access-control mechanisms that do not depend on the affected os.Root implementation. Audit existing applications to confirm whether os.Root is used for security boundaries.

Patch guidance

Check the official Go releases and security advisories for the patched version addressing CVE-2026-39822. Update your Go toolchain and rebuild all applications that depend on it. Test the patched version in a staging environment before production deployment. Verify that symlink paths with trailing slashes are now correctly rejected or handled without escaping the root boundary.

Detection guidance

Monitor for failed file-access attempts or errors in logs where paths containing symlinks with trailing slashes are referenced through os.Root operations. Review application code for use of os.Root and test with symlink paths ending in '/' to confirm the vulnerability is present or fixed. On affected systems, audit filesystem access patterns for unexpected escapes to parent directories or out-of-bounds locations. Security event logs may show privilege boundary violations if the vulnerability has been exploited.

Why prioritize this

HIGH severity (CVSS 7.8) due to the combination of local exploitability, high impact on confidentiality/integrity/availability, and common use of Go in infrastructure and containerized environments. The vulnerability directly undermines filesystem isolation guarantees that users depend on for security. Organizations using Go for multi-tenant or sandboxed applications should prioritize patching immediately.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L)—requires user-level access but not network exposure; Attack Complexity Low (AC:L)—no special conditions needed; Privileges Required Low (PR:L)—standard user can exploit; User Interaction None (UI:N)—automatic; Scope Unchanged (S:U)—impact is within the affected component; Confidentiality High (C:H)—sensitive files can be read; Integrity High (I:H)—files can be modified; Availability High (A:H)—files can be deleted. The elevation from MEDIUM to HIGH is driven by the complete compromise of file confidentiality, integrity, and availability for a local attacker.

Frequently asked questions