CVE-2026-39819

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the 'go bug' command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.

This vulnerability is rated as Moderate because exploitation requires local access, explicit user interaction to invoke an interactive diagnostic utility, and pre-existing control of shared temporary locations. The affected tool, designed exclusively for manually filing upstream bug reports, is not executed by automated build systems, cluster controllers, or container workloads in Red Hat products. In addition, standard hardening configurations in Red Hat Enterprise Linux, specifically protected symlinks (fs.protected_symlinks), prevent unprivileged accounts from redirecting file operations through symlinks in world-writable sticky directories.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.