git-annex 10.20261026 fixes cross-repo data exfiltration
Original title: CVE-2026-112818: git-annex cross-repository data exfiltration
Joey Hess also published backport branches for several earlier git-annex releases, named for CVE-2026-112818.
Joey Hess announced on October 26 that git-annex 10.20261026 fixes a cross-repository data exfiltration issue tracked as CVE-2026-112818. Backported patches for several past versions are available as branches in the git repository, including patches labeled for 10.20250416, 10.20251029, and 10.20261006. The mailing-list snippet does not describe the exploit path or say whether it has been used in attacks.
Unconfirmed: The snippet does not state the full set of affected versions or any exploitation.
- The fixed release is git-annex 10.20261026.
- Named backport branches include CVE-2026-112818-patch-10.20250416.
- Other listed branches cover 10.20251029 and 10.20261006.
- The post points to the git-annex download page.
Impact: cross-repository data exfiltration
| Product | Affected | Fixed in |
|---|---|---|
| git-annex | — | 10.20261026 |
- 1.Upgrade to git-annex 10.20261026 or apply the published backport branches.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112818 | — | — | — |
From the original article
Posted by Joey Hess on Oct 26 I have released git-annex 10. 20261026, which fixes a cross-repository https://git-annex. branchable.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.