{"id":"CVE-2026-56857","kind":"vulnerability","aliases":["CVE-2026-56857","GO-2026-6604"],"related":[],"title":"Root.Mkdir(All) can follow junctions out of the root on Windows in os","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","summary":"Go's os.Root Mkdir and MkdirAll on Windows can follow a junction at the final path component and create a directory at the junction's target even when that target lies outside the root. An attacker who can plant or control a junction inside the root can create directories anywhere the Go process has write access.","severity":"critical","cvss":9.8,"epss":0.00493,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","os.root","runtime","self-hosted","windows"],"not_affected_if":["go-below-1.27.0-or-patched","no-os.root-mkdir-use","non-windows-hosts","paths-not-attacker-influenced"],"how_to_check":"Find Go binaries or source modules built with go1.26.x before 1.26.9 or go1.27.x before 1.27.2 on Windows; run 'go version -m <binary>' or 'go version' to see the toolchain.\nSearch code for os.Root usage calling Mkdir or MkdirAll on paths that untrusted users can influence.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild Windows binaries.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:50:58+00:00","updated_at":"2026-10-23T19:50:58+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:50:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild Windows binaries.\nunknown for a workaround that avoids upgrading.","summary":"Go's os.Root Mkdir and MkdirAll on Windows can follow a junction at the final path component and create a directory at the junction's target even when that target lies outside the root. An attacker who can plant or control a junction inside the root can create directories anywhere the Go process has write access.","category":"runtime","who_cares":["go","windows","os.root","self-hosted"],"confidence":0.8,"analyst_note":"Check the GO-2026-6604 advisory at https://pkg.go.dev/vuln/GO-2026-6604 for any mitigation beyond upgrading and whether the 1.26.x line is affected from its own range, since the product range lists only 1.27.0 to 1.27.2 as affected.","how_to_check":"Find Go binaries or source modules built with go1.26.x before 1.26.9 or go1.27.x before 1.27.2 on Windows; run 'go version -m <binary>' or 'go version' to see the toolchain.\nSearch code for os.Root usage calling Mkdir or MkdirAll on paths that untrusted users can influence.\nunknown for whether a specific deployment is reachable without a source check.","needs_analyst":true,"not_affected_if":["non-windows-hosts","no-os.root-mkdir-use","paths-not-attacker-influenced","go-below-1.27.0-or-patched"],"severity_if_unknown":"critical"},"cost_usd":0.000479,"input_tokens":2124,"output_tokens":534,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A,21A '-56857':16A,22A '-6604':19A 'access':86B 'anywher':80B 'appli':125C 'attack':66B 'compon':47B,132C 'control':71B 'creat':49B,78B,107C 'cve':14A,20A 'directori':51B,79B,109C 'empti':102C 'even':57B,114C 'final':45B 'follow':4A,40B 'go':17A,24B,31B,82B 'host':29B 'insid':74B 'junction':5A,42B,54B,73B,98C,112C,135C 'last':130C 'lie':61B 'locat':103C,119C 'mkdir':34B 'mkdiral':36B 'oper':105C,127C 'os':13A 'os.root':25B,33B 'outsid':62B,120C 'path':46B,131C 'path/junction/target':139C 'path/to/junction':136C 'plant':69B 'point':99C 'process':83B 'root':9A,64B,76B,122C 'root.mkdir':1A,93C 'root.mkdirall':95C 'runtim':26B 'self':28B 'self-host':27B 'stdlib':23A 'target':56B,60B,91C,113C,117C 'window':11A,30B,38B,88C 'write':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6604","url":"https://pkg.go.dev/vuln/GO-2026-6604","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56857","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56857","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","severity":null,"published_at":"2026-10-08T23:17:01+00:00","modified_at":"2026-10-09T16:35:35+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}