CVE-2022-29526

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

• CWE-269

• https://github.com/golang/go/issues/52313Exploit, Issue Tracking, Patch, Third Party Advisory
• https://groups.google.com/g/golang-announceIssue Tracking, Mailing List, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdUMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220729-0001/Third Party Advisory
• https://github.com/golang/go/issues/52313Exploit, Issue Tracking, Patch, Third Party Advisory
• https://groups.google.com/g/golang-announceIssue Tracking, Mailing List, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdUMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220729-0001/Third Party Advisory

Published

Jun 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2952GE CIMPICITY versions 2022 and prior is vulnerable when da…7.8
• CVE-2022-29520An OS command injection vulnerability exists in the console_…9.8
• CVE-2022-29522Use after free vulnerability exists in the simulator module …7.8
• CVE-2022-29523Improper conditions check in the Open CAS software maintaine…5.5
• CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
• CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
• CVE-2022-29527Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a worl…7
• CVE-2022-29528An issue was discovered in MISP before 2.4.158. PHAR deseria…9.8
• CVE-2022-29529An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-2953LibTIFF 4.4.0 has an out-of-bounds read in extractImageSecti…5.5
• CVE-2022-29530An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29531An issue was discovered in MISP before 2.4.158. There is sto…5.4