—

GO-2026-5890

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery

Details

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/kerberos-io/agent/machinery

Introduced in: 0 Fixed in: 0.0.0-20260528173546-51f1a52e170f

Fix go get github.com/kerberos-io/agent/machinery@v0.0.0-20260528173546-51f1a52e170f

References

https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j [ADVISORY]
https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09 [WEB]