High severity8.8NVD Advisory· Published Apr 21, 2026· Updated Jul 15, 2026
CVE-2026-40611
CVE-2026-40611
Description
Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/go-acme/lego/v4Go | < 4.34.0 | 4.34.0 |
github.com/go-acme/lego/v3Go | <= 3.9.0 | — |
github.com/go-acme/legoGo | <= 2.7.2 | — |
Affected products
11- osv-coords11 versionspkg:apk/chainguard/sftpgopkg:apk/chainguard/traefik-2.11pkg:apk/chainguard/traefik-3.6pkg:apk/chainguard/traefik-fips-2.11pkg:apk/chainguard/traefik-fips-3.6pkg:apk/wolfi/sftpgopkg:apk/wolfi/traefik-3.6pkg:golang/github.com/go-acme/legopkg:golang/github.com/go-acme/lego/v3pkg:golang/github.com/go-acme/lego/v4pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 2.7.1-r8+ 10 more
- (no CPE)range: < 2.7.1-r8
- (no CPE)range: < 2.11.44-r0
- (no CPE)range: < 3.6.13-r2
- (no CPE)range: < 2.11.44-r0
- (no CPE)range: < 3.6.13-r2
- (no CPE)range: < 2.7.1-r8
- (no CPE)range: < 3.6.13-r2
- (no CPE)range: <= 2.7.2
- (no CPE)range: <= 3.9.0
- (no CPE)range: < 4.34.0
- (no CPE)range: < 0.0.20260727T201416-160000.1.1
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-qqx8-2xmm-jrv8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40611ghsaADVISORY
- github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8nvdWEB
- access.redhat.com/errata/RHSA-2026:21772nvd
- access.redhat.com/security/cve/CVE-2026-40611nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40611.jsonnvd
News mentions
0No linked articles in our index yet.