How to fix fatal: detected dubious ownership in repository at '/path/to/repo' in Git

GitBEGINNERHIGHUpdated Dec 6, 2025· 434 views

This Git security error occurs when the repository owner differs from the user running Git commands. Added in Git 2.35.2 to address CVE-2022-24765, it prevents arbitrary code execution via malicious Git hooks.

Quick fix

Fixes fatal: detected dubious ownership in repository at '/path/to/repo'

# Check repository owner
ls -la /path/to/repo/.git

# Check current user
whoami
id
  1. Identify the ownership mismatch
  2. Add the repository to Git's safe.directory list
  3. Fix ownership of the repository (preferred for security)
  4. Trust all directories globally (use with caution)
git — error
# Check repository owner
ls -la /path/to/repo/.git
# Check current user
whoami
id
fatal: detected dubious ownership in repository at '/path/to/repo'

What this error means

Starting with Git version 2.35.2, Git performs an ownership check before executing commands in a repository. If the user running a Git command is different from the user who owns the `.git` directory, Git refuses to operate and displays this "dubious ownership" error. This security measure was introduced to address CVE-2022-24765, a vulnerability that could allow arbitrary code execution on multi-user systems. The attack vector works as follows: an attacker could create a malicious `.git` directory in a shared location (like `C:\.git` on Windows or `/tmp` on Linux). When an unsuspecting user navigates to that directory and runs any Git command—or even just has a Git-aware shell prompt—Git hooks in the malicious repository could execute arbitrary code with that user's privileges. This check is especially important in CI/CD pipelines, Docker containers, and shared development environments where files may be owned by different users than the one executing commands. While the error may seem inconvenient, it protects against a serious class of privilege escalation attacks.

Typical symptoms

  • All Git commands fail with 'fatal: detected dubious ownership in repository' message
  • Error appears after upgrading Git to version 2.35.2 or later
  • CI/CD pipelines fail at Git checkout or status steps
  • Docker containers fail when running Git commands on mounted volumes
  • Git-aware shell prompts (like Oh My Zsh or posh-git) cause errors when entering the directory

Common causes

  1. Repository directory is owned by a different user than the one running Git (most common)
  2. Running Git commands as root on a repository owned by a regular user
  3. Docker or container environment where mounted volumes have different ownership
  4. CI/CD pipeline running as a different user than the one who cloned the repository
  5. Shared network drives or NFS mounts where ownership mapping differs between systems
  6. WSL (Windows Subsystem for Linux) accessing repositories on the Windows filesystem

How to fix "fatal: detected dubious ownership in repository at '/path/to/repo'"

1Identify the ownership mismatch

First, check who owns the repository and who is running the command:

bash
# Check repository owner
ls -la /path/to/repo/.git

# Check current user
whoami
id

The owner shown by ls should match your current user. If they differ, you've confirmed the ownership mismatch.

2Add the repository to Git's safe.directory list

The most common fix is to tell Git to trust this specific repository:

bash
# Add specific repository to safe list
git config --global --add safe.directory /path/to/repo

Replace /path/to/repo with the actual absolute path shown in the error message.

For Windows users, use forward slashes and the full path:

bash
git config --global --add safe.directory C:/Users/username/project

Important: Use the exact path from the error message. Git resolves paths canonically, so relative paths or paths with symlinks may not match.

3Fix ownership of the repository (preferred for security)

If possible, change the repository ownership to match your user. This is the most secure solution:

On Linux/macOS:

bash
# Change ownership of the entire repository
sudo chown -R $(id -u):$(id -g) /path/to/repo

On Windows (run as Administrator):

powershell
takeown /F C:\path\to\repo /R /D Y
icacls C:\path\to\repo /grant %USERNAME%:F /T

This is safer than marking the directory as safe because it eliminates the ownership discrepancy entirely.

4Trust all directories globally (use with caution)

If you're on a single-user machine and understand the security implications, you can disable this check entirely:

bash
git config --global --add safe.directory '*'

Warning: This trusts ALL repositories on your system, including potentially malicious ones. Only use this on:
- Personal development machines you fully control
- Dedicated CI runners with no shared access
- Containers with no access to untrusted repositories

5Configure for CI/CD pipelines (GitHub Actions, GitLab CI, etc.)

For CI/CD environments, use the --system flag instead of --global:

bash
git config --system --add safe.directory '*'

GitHub Actions example:

yaml
- name: Trust repository
  run: git config --global --add safe.directory ${{ github.workspace }}

GitLab CI example:

yaml
before_script:
  - git config --global --add safe.directory "$CI_PROJECT_DIR"

For container-based runners, you may need to add this to the container's global Git config.

6Fix Docker container ownership issues

When running Git in Docker with mounted volumes, ownership often differs between host and container:

Option 1: Match the container user to the host user:

bash
docker run --user $(id -u):$(id -g) -v /path/to/repo:/repo myimage

Option 2: Add safe.directory in your Dockerfile or entrypoint:

dockerfile
RUN git config --system --add safe.directory '*'

Option 3: Set GIT_DISCOVERY_ACROSS_FILESYSTEM (for specific cases):

bash
docker run -e GIT_CEILING_DIRECTORIES=/repo -v /path/to/repo:/repo myimage
7Verify the fix

After applying your chosen fix, verify that Git commands work:

bash
# Should no longer show the error
cd /path/to/repo
git status

# View your safe.directory settings
git config --show-origin --get-all safe.directory

If you need to remove a safe.directory entry later:

bash
# Remove specific entry
git config --global --unset safe.directory /path/to/repo

# Remove all entries
git config --global --unset-all safe.directory

Advanced notes

### Understanding CVE-2022-24765

This vulnerability (CVSS score 9.8 - Critical) exploits how Git searches for a .git directory. Before the fix, Git would traverse up the directory tree looking for a repository, which could lead it to find an attacker-placed .git directory in a parent path like C:\.git on Windows or in shared directories like /tmp on Linux.

Malicious Git hooks (like pre-auto-gc or post-checkout) in such directories could execute arbitrary code when a victim:
- Runs any Git command
- Opens the directory in a Git-aware IDE (VS Code, IntelliJ)
- Uses a shell prompt that calls git status (Oh My Zsh, posh-git, starship)

### WSL (Windows Subsystem for Linux) Considerations

WSL accessing Windows filesystem paths often triggers this error because files appear owned by root or a different user. Common fixes:

bash
# Add Windows paths to safe.directory
git config --global --add safe.directory /mnt/c/Users/YourName/project

# Or trust all Windows paths (use carefully)
git config --global --add safe.directory '/mnt/c/*'

For better performance and ownership consistency, consider cloning repositories into the Linux filesystem (/home/user/) instead of the Windows filesystem (/mnt/c/).

### Related Vulnerability: CVE-2022-29187

Git 2.37.1 addressed a follow-up vulnerability where the ownership check could be bypassed when running as root. If you're running Git as root on shared systems, ensure you're on Git 2.37.1 or later.

### When NOT to Use safe.directory

Avoid using safe.directory '*' on:
- Multi-user systems where you don't trust all users
- Production servers with shared access
- Any system where untrusted users can create directories

In these environments, either fix ownership or add only specific trusted paths.

Frequently asked questions

What does "fatal: detected dubious ownership in repository at '/path/to/repo'" mean?
2, Git performs an ownership check before executing commands in a repository. git directory, Git refuses to operate and displays this "dubious ownership" error. This security measure was introduced to address CVE-2022-24765, a vulnerability that could allow arbitrary code execution on multi-user systems.
How do I fix "fatal: detected dubious ownership in repository at '/path/to/repo'"?
This Git security error occurs when the repository owner differs from the user running Git commands. Added in Git 2.35.2 to address CVE-2022-24765, it prevents arbitrary code execution via malicious Git hooks.
What causes "fatal: detected dubious ownership in repository at '/path/to/repo'"?
Repository directory is owned by a different user than the one running Git (most common) Running Git commands as root on a repository owned by a regular user Docker or container environment where mounted volumes have different ownership
Is the "fatal: detected dubious ownership in repository at '/path/to/repo'" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading