Description

Private Repository Existence Disclosure via go-get Meta Endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T17:17:28.653Z",
  "pubdate": "2026-08-13T17:17:28.653Z",
  "executiveSummary": "The vulnerability is an information disclosure flaw that allows remote attackers to determine the existence of private repositories via the go-get meta endpoint. This security issue impacts systems utilizing the Go module ecosystem and repository hosting services implementing the go-get protocol. The primary risk implication is unauthorized reconnaissance, enabling threat actors to enumerate private assets and organization structures without authentication. Attacker capabilities are limited to confirming the existence or non-existence of specific private resources based on differential responses returned by the endpoint. Exploitation requirements involve network access to the target endpoint and knowledge or generation of target repository naming conventions. No complex privileges or prior authentication are mandated to execute the probing technique, making it a viable reconnaissance vector for external adversaries seeking to map internal infrastructure or proprietary software developments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of repository visibility states within the go-get meta endpoint logic. When the Go command-line tool or a compatible HTTP client requests a package with the query parameter go-get=1, the server responds with specific HTML meta tags defining the import path and version control system source. In vulnerable implementations, the endpoint fails to enforce strict authorization checks before returning metadata responses for private repositories. Consequently, differential response analysis can be performed by an attacker to distinguish between public, private, or non-existent repositories. The attack flow begins when an unauthenticated client sends an HTTP GET request to a target repository path appending the go-get=1 query parameter. If the repository exists as a private resource, the server may return a distinct HTTP status code, error message, or partial metadata structure that diverges from the response generated for completely non-existent paths. This discrepancy leaks boolean state information regarding the existence of the private repository. The vulnerable component is the HTTP routing and metadata generation handler responsible for servicing go-get requests. The network exposure is external, as these endpoints are typically exposed to the public internet to facilitate module downloads for legitimate developers. The payload behavior involves automated enumeration scripts querying arbitrary or dictionary-based repository names to harvest valid internal paths. Post-exploitation impact is strictly limited to information disclosure, specifically repository enumeration, but this intelligence significantly aids subsequent targeted attacks by revealing the naming conventions and organizational layout of private intellectual property."
}