CVE-2026-32282 Golang CVE debrief

Who should care

Users of Go versions prior to 1.25.10 or 1.26.3 on Linux systems should be aware of this vulnerability. This includes developers and administrators who use Go for building applications that may be exposed to untrusted inputs or operate in environments where symlink attacks are a concern.

Technical summary

The vulnerability exists in the Root.Chmod function of the Go programming language. On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. This is due to the Linux fchmodat syscall silently ignoring the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. The impact is limited because Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root.

Defensive priority

Apply patches or updates provided by the Go project to address this vulnerability. Review and update Go applications to ensure they handle file system operations securely, especially in environments exposed to untrusted inputs.

Recommended defensive actions

• Apply the official patches provided by the Go project.
• Review and update Go applications to handle file system operations securely.
• Monitor for and address potential symlink attacks in environments exposed to untrusted inputs.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-08T02:16:03.467Z and last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. Vendor advisories and patches are available. Evidence is limited to public sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify system configurations, review logs for suspicious activity related to file system operations, and monitor for potential symlink attacks.

Official resources