git-annex: Cross-repository data exfiltration (CVE-2026-112818)
A security vulnerability in git-annex (CVE-2026-112818) allows for unauthorized cross-repository data exfiltration, requiring an update to version 10.20261026 or the application of backported patches.
CVE search metadata
CVE search record: CVE-2026-112818. KEV: no. Product: git-annex (< 10.20261026). Brief: git-annex: Cross-repository data exfiltration (CVE-2026-112818). Brief link: https://feed.craftedsignal.io/briefs/2026-10-git-annex-data-exfiltration/
Triage facts
Revision 1- Applicability
- git-annex (< 10.20261026)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 27, 21:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
git-annex versions prior to 10.20261026 are vulnerable to a cross-repository data exfiltration flaw, tracked as CVE-2026-112818. This vulnerability allows for unauthorized access or leakage of data between managed repositories. The maintainer has released a patched version and provided backported patches for previous releases to address the risk.
Impact
Successful exploitation allows for the unauthorized exfiltration of data across repositories managed by git-annex, potentially leading to the exposure of sensitive information stored in those environments.
Recommendation
- Upgrade git-annex to version 10.20261026 or apply the available backported patches provided by the maintainer for older versions.
- Inventory systems utilizing git-annex to identify versions requiring the security update.
Mitigations
Upgrade git-annex to version 10.20261026 or apply backported patches
CVE-2026-112818