go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    Update to version 1.19.2:

     * Remove withdrawn lib/pq CVEs from govulncheck
     * Add backticks to component name in generated doc output
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
     * Add nop receiver to OTel Engine
     * Backport dependency upgrades to address GO-2026-6061

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,
    worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree
    without confining resolution to the worktree boundary, so a maliciously crafted repository containing a
    symlink can cause go-git to read from or write to files outside the intended working directory when the
    repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
    (CVE-2026-71556)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    - Update to version 1.19.2.
    - Update to version 1.19.1.
    - Update to version 1.19.0:
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
    - Update to version 1.18.1:
     * Add nop receiver to OTel Engine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory.

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree     without confining resolution to the worktree boundary, so a maliciously crafted repository containing a     symlink can cause go-git to read from or write to files outside the intended working directory when the     repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
    (CVE-2026-71556)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     reference names are not sanitized before being used to construct on-disk paths under the reference storage     directory, so a maliciously crafted reference name (for example containing directory-traversal sequences)     can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and     6.0.0-alpha.5 fix the issue. (CVE-2026-71557)

    A server-side request forgery issue due to improper validation of equivalent address representations in     the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before     3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination     denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a     managed instance and acting with that role's permissions from outside the instance, via a crafted     destination host value that uses an alternate representation of a denied link-local address.



    To remediate this issue, users should upgrade to version 3.3.4851.0 or later. (CVE-2026-89049)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3149 advisory.

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree     without confining resolution to the worktree boundary, so a maliciously crafted repository containing a     symlink can cause go-git to read from or write to files outside the intended working directory when the     repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
    (CVE-2026-71556)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     reference names are not sanitized before being used to construct on-disk paths under the reference storage     directory, so a maliciously crafted reference name (for example containing directory-traversal sequences)     can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and     6.0.0-alpha.5 fix the issue. (CVE-2026-71557)

    A server-side request forgery issue due to improper validation of equivalent address representations in     the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before     3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination     denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a     managed instance and acting with that role's permissions from outside the instance, via a crafted     destination host value that uses an alternate representation of a denied link-local address.



    To remediate this issue, users should upgrade to version 3.3.4851.0 or later. (CVE-2026-89049)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3933 advisory.

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree     without confining resolution to the worktree boundary, so a maliciously crafted repository containing a     symlink can cause go-git to read from or write to files outside the intended working directory when the     repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
    (CVE-2026-71556)

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     reference names are not sanitized before being used to construct on-disk paths under the reference storage     directory, so a maliciously crafted reference name (for example containing directory-traversal sequences)     can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and     6.0.0-alpha.5 fix the issue. (CVE-2026-71557)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21884-1 advisory.

    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278681).
    - CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution     (bsc#1276981).
    - CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the     reference storage       (bsc#1276994).

    Changes for amazon-ssm-agent:

    - Update to version 3.3.5390.0
     * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3
     * Bump golang.org/x/crypto from v0.53.0 to v0.56.0
     * Bump golang.org/x/net from v0.56.0 to v0.57.0
     * Bump golang.org/x/sys from v0.46.0 to v0.47.0
     * Upgrade GoLang version from 1.25 to 1.26
     * Mint control-channel token after dial to fix AZ-fault token expiry
     * Resume patch documents interrupted by an external shutdown
     * Use systemctl for systemd in aws: configureDocker on Amazon Linux
     * Update greengrass component version to 1.3.5

    - Update to version 3.3.5226.0
     * Add bounds check for HeaderLength in AgentMessage Deserialize
     * Bump github.com/go-git/go-git/v5 to v5.19.2
     * Bump golang.org/x/sync to v0.21.0
     * Detect Azure Linux and potential future unregistered Linux platforms
     * Fix Windows session command parsing by removing shlex
     * Fix shell injection in Windows domainjoin plugin parameters
     * Prevent control channel deadlock on ProcessorBufferFull
     * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
     * Update the logic for loading RegistrationInfo
     * Upgrade Go version to 1.25.13

    - Update to version 3.3.5068.0

     * Migrate from aws-sdk-go v1 to aws-sdk-go-v2
     * Fix flaky registration/connection channel tests
     * Sync AWS SDK fork in extra/ with multicloud vendor changes
     * Harden function create file with permissions in a single syscall
     * Upgrade Go version to 1.25.12
     * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0
     * Fix loopback bypass in remote-host port forwarding denylist

    - Update to version 3.3.4851.0

     * Add ECS/EKS credential endpoints and loopback to port-forward denylist
     * Canonicalize IP addresses before port-forwarding denylist check
     * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin      instead of the -w flag
     * Fix false StuckAtInProgress timeout for associations with rate >= 2h
     * Fix non-interactive session big file transfer issues
     * Prevent ssm-user race condition with flock-based serialization
     * Send AWS::EC2::Instance as source type when registered with provider EC2
     * Validate process name in orphan worker detection

    - Update to version 3.3.4793.0

     * Add multicloud support enabling SSM Agent registration with      Azure cloud providers
     * Add support for the upcoming public key in the agent code

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4286-1 advisory.

    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1278681)
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278681)
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278681).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276981).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276994).

    Changes for amazon-ssm-agent:

    - Update to version 3.3.5390.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4082-1 advisory.

    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276981).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276994).

    Changes for amazon-ssm-agent:

    - Update to version 3.3.5226.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68335 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security Fixes:

    * flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)
    * flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
    * flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
    * flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints     (CVE-2026-48050)
    * flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
    * flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
    * flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
    * flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68334 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security Fixes:

    * flightctl: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
    * flightctl: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
    * flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)
    * flightctl: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * flightctl: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
    * flightctl: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check     (CVE-2026-39831)
    * flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
    * flightctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup     (CVE-2026-42306)
    * flightctl: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
    * flightctl: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
    * flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
    * flightctl: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs     (CVE-2026-46597)
    * flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints     (CVE-2026-48050)
    * flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
    * flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
    * flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
    * flightctl: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
    * flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)
    * flightctl: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite     (CVE-2026-81521)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5,     worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree     without confining resolution to the worktree boundary, so a maliciously crafted repository containing a     symlink can cause go-git to read from or write to files outside the intended working directory when the     repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
    (CVE-2026-71556)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364343	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)	Nessus	SuSE Local Security Checks	Local	high
472767	Echo: github.com/go-git/go-git/v5: security update to 5.19.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
472767	Echo: github.com/go-git/go-git/v5: security update to 5.19.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
362571	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)	Nessus	SuSE Local Security Checks	Local	high
358434	Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)	Nessus	Amazon Linux Local Security Checks	Local	high
353440	Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3149)	Nessus	Amazon Linux Local Security Checks	Local	high
351032	Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3933)	Nessus	Amazon Linux Local Security Checks	Local	high
350145	openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:21884-1)	Nessus	SuSE Local Security Checks	Local	high
349189	SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:4286-1)	Nessus	SuSE Local Security Checks	Local	high
348457	SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:4082-1)	Nessus	SuSE Local Security Checks	Local	high
346435	RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.1 Security Update (Important) (RHSA-2026:68335)	Nessus	Red Hat Local Security Checks	Local	high
346432	RHEL 10 / 9 : Red Hat Edge Manager Version 1.1.4 Security Update (Important) (RHSA-2026:68334)	Nessus	Red Hat Local Security Checks	Local	high
333378	Linux Distros Unpatched Vulnerability : CVE-2026-71556	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-71556

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high