Go standard library os: Junction following out of root on Windows
Summary
On Windows, Root.Mkdir and Root.MkdirAll in the Go standard library os package can follow a junction whose target is an empty location outside the root and create a directory there. The issue only applies when the last path component is a junction. An attacker who can create junctions in a tree that Go code confines with os.Root could create directories outside that tree, which the CVSS vector rates as high impact; no exploitation has been reported.
Affected
- Go standard library os: before go1.26.9; go1.27.0-0 up to before go1.27.2
- Go standard library internal/syscall/windows: before go1.26.9; go1.27.0-0 up to before go1.27.2
- Platform: Windows only
- Binaries built with an affected toolchain are affected.
Fixed in
- Go 1.26.9 (1.26 branch)
- Go 1.27.2 (1.27 branch)
- Binaries must be rebuilt with a fixed toolchain to be fixed.
Workaround
- No vendor workaround known.
- Limit who can create junctions in directory trees that Go code confines with os.Root on Windows.
- Do not use os.Root on attacker-influenced paths until the binary is rebuilt.
Exploitation
- Exploited in the wild: no evidence found. CISA SSVC lists exploitation as none, automatable as yes.
- Not listed in CISA KEV.
- No public proof-of-concept found.
- Exploitation requires write access to the confined tree to create a junction.
Our recommendation
- Identify Windows systems running Go binaries that use os.Root on untrusted paths.
- Update the Go toolchain to 1.26.9 or 1.27.2 and rebuild affected binaries.
- Check whether third-party Windows software ships with a fixed Go version.
- If an immediate update is not possible, document the risk and apply the interim measures above.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Go vulnerability database GO-2026-6604 pkg.go.dev
- OSV BIT-golang-2026-56857 osv.dev
- Go fix commit CL 847305 go.dev
- Go issue 81739 go.dev
- Go announcement golang-announce groups.google.com
- OpenCVE CVE-2026-56857 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:08.
Original description (NVD)
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.