CVE-2022-23773: Golang Go

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Affected products

• Golang Go: before 1.16.14 (fixed in 1.16.14); from 1.17.0, before 1.17.7 (fixed in 1.17.7)
• Netapp Beegfs Csi Driver: affected versions not specified
• Netapp Cloud Insights Telegraf Agent: affected versions not specified
• Netapp Kubernetes Monitoring Operator: affected versions not specified
• Netapp Storagegrid: affected versions not specified

Published 2022-02-11. Last modified 2026-06-17.