CVE-2026-40611: Go-Acme Lego

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Affected products

• Go-Acme Lego: before 4.34.0 (fixed in 4.34.0)
• Red Hat Red Hat Openshift Dev Spaces 3.28: before 1779786779 (fixed in 1779786779)

Published 2026-04-21. Last modified 2026-07-15.