CVE-2026-56857 Go standard library CVE debrief

Who should care

Defenders responsible for Go deployments, especially those using the `os` package on Windows, should assess exposure and prioritize verification and patching. This includes reviewing affected versions, applying patches or mitigations, and monitoring for suspicious activity. Security teams and vulnerability management teams should also be aware of the potential impacts and take necessary actions to protect their environments.

Why it matters

This vulnerability in the Go standard library's `os` package can lead to unintended directory creation on Windows systems. Defenders should assess exposure, prioritize verification and patching of affected deployments, and monitor for suspicious activity.

• Potential unauthorized directory creation outside intended root directories on Windows systems using affected Go versions
• Need for verification of affected versions and application of patches or mitigations
• Monitoring for unusual directory creation patterns to detect potential exploitation attempts

Technical summary

The vulnerability occurs when the target of `Root.Mkdir` or `Root.MkdirAll` is a junction pointing to an empty location on Windows. This allows the creation of a directory at the junction target even if it's outside the root. The issue only affects operations where the last path component is a junction. Affected Go versions include those prior to 1.26.9 or 1.27.2. Defenders should assess exposure and prioritize verification of affected Go deployments, especially those using `os` package functionality on Windows, and apply patches or mitigations as necessary.

Defensive priority

Defenders should assess exposure and prioritize verification of affected Go deployments, especially those using `os` package functionality on Windows.

Recommended defensive actions

• Assess exposure of Go deployments using `os` package functionality on Windows
• Verify affected versions (prior to 1.26.9 or 1.27.2) and apply patches
• Monitor for unusual directory creation patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the source item from osv_dev, which provides details on the affected Go versions and the conditions under which the vulnerability occurs. The source item notes that the issue is relevant to Go versions prior to 1.26.9 or 1.27.2. Defenders should verify affected versions and apply patches or mitigations as necessary. The vulnerability allows for potential unauthorized directory creation outside intended root directories on Windows systems using affected Go versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.