—

GO-2026-5890

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery

Quick fix

GO-2026-5890 — github.com/kerberos-io/agent/machinery: upgrade to the fixed version with the command below.

go get github.com/kerberos-io/agent/machinery@v0.0.0-20260528173546-51f1a52e170f

Details

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/kerberos-io/agent/machinery

Introduced in: 0Fixed in: 0.0.0-20260528173546-51f1a52e170f

Fixgo get github.com/kerberos-io/agent/machinery@v0.0.0-20260528173546-51f1a52e170f

References

https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j[ADVISORY]
https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09[WEB]