Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Git LFS Allows Unauthorized Access to Sensitive Data on Red Hat Systems
published 6 months ago
Summary
An update is available for Git LFS on Red Hat systems to fix a security issue. If left unpatched, an attacker could potentially access sensitive data, such as credentials and large files, without authorization. Apply the update to ensure your system remains secure.
What to do
- Update redhat git-lfs to version 0:3.6.1-8.el10_1.
- Update redhat git-lfs-debuginfo to version 0:3.6.1-8.el10_1.
- Update redhat git-lfs-debugsource to version 0:3.6.1-8.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.1 | redhat | git-lfs |
< 0:3.6.1-8.el10_1 Fix: upgrade to 0:3.6.1-8.el10_1
|
| Red Hat:enterprise_linux:10.1 | redhat | git-lfs-debuginfo |
< 0:3.6.1-8.el10_1 Fix: upgrade to 0:3.6.1-8.el10_1
|
| Red Hat:enterprise_linux:10.1 | redhat | git-lfs-debugsource |
< 0:3.6.1-8.el10_1 Fix: upgrade to 0:3.6.1-8.el10_1
|
Original advisory text
Red Hat Security Advisory: git-lfs security update
References
- https://access.redhat.com/errata/RHSA-2026:7005 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7005.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
- https://go.dev/cl/752180 Third Party Advisory
- https://go.dev/issue/77578 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published9 Apr 2026
Updated24 Apr 2026
First seen24 Apr 2026
Sources
RHSA-2026:7005 · OSV
Track software like this
Free during beta