CVE-2026-58507

CVE-2026-58507 is a go-get protocol information disclosure that lets external attackers determine whether private repositories exist without authenticating. When an attacker probes a go-get endpoint for 'github.com/org/private-repo', the response differs between "repo does not exist" and "repo exists but you cannot access it" — that differential is the enumeration channel. This is not a new vulnerability in the traditional sense; it's forgotten infrastructure that was likely always leaky but never audited against modern threat models. The CVSS 5.3 and EPSS 0.00237 are misleading metrics for this case. This is not a standalone remote exploit — no one gets compromised via go-get enumeration alone. The actual risk is as a force multiplier in chained attacks. An attacker who already has initial access (phishing, credential reuse, any initial foothold) can use this enumeration to map your internal repo structure in hours instead of weeks, revealing which repos contain secrets, infrastructure-as-code, or sensitive tooling. The blast radius is conditional but devastating when triggered. Audit your deployment: identify any go-get endpoint exposed to unauthenticated or internet-probeable surfaces. This includes self-hosted GitLab, Gitea, or similar instances. The fix is returning uniform responses for non-public or non-existent repos — the endpoint should give attackers nothing beyond "no module here" regardless of whether the repo exists behind authentication. If you cannot enforce uniform responses, restrict network-level access to the go-get endpoint to authenticated users only. Assume this technique is already weaponized. The CVE publication gives threat actors a name, a search term, and a reproducible method. Even with low automated exploitation probability, the disclosure itself expands your exposure window until platforms ship uniform-404 patches. Prioritize containment now; the remediation timeline across all Go hosting platforms will be measured in years, not weeks.

Reviewed through automated stages and approved by a human before publication.