CVE-2022-26945: Hashicorp Go-Getter

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Affected products

• Hashicorp Go-Getter: up to and including 1.5.11; version 2.0.2 only

Published 2022-05-25. Last modified 2026-06-17.