git-annex: cross-repo data exfiltration

git-annex

git-annex vulnerability allows cross-repository data exfiltration, fixed in version 10.20261026

Do this now

Upgrade git-annex to 10.20261026 on every repository host now.

Fix it

Upgrade to git-annex 10.20261026

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 19:18 UTC
Fixed in: 10.20261026
Identifiers: CVE-2026-112818 ID not published yet
Source: news
On the menu as: Linux server software

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## git-annex: cross-repo data exfiltration
Severity: unknown. Patch status: patched.
Affected: git-annex
Fixed in: 10.20261026
Ids: CVE-2026-112818

git-annex vulnerability allows cross-repository data exfiltration, fixed in version 10.20261026

## Steps
1. Search the repo, its CI and infra config for git-annex. If present, report the version in use and whether it's affected.
2. Fix by release line: git-annex: 10.20261026.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| git-annex | fixed | 10.20261026 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-112818") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/394
https://pwned.coffee/i/git-annex-cross-repo-data-exfiltration-cve-2026-112818

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
git-annex before 10.20261026 10.20261026 Reported checked 26 Oct
Score: No CVSS published yet: severity unknown.
Last checked: 26 Oct 2026, 20:41 UTC

Product	Affected	Fixed in	Source
git-annex	before 10.20261026	10.20261026	Reported checked 26 Oct

Sources: KEV – CVE record – Vendor –

Sources

seclists.org: CVE-2026-112818: git-annex cross-repository data exfiltration

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee