GNU Savannah Flaws Exposed Bash Maintainer Controls and Enabled Root Access

Hacktron researchers identified 26 confirmed vulnerabilities in Savane, the software powering GNU Savannah, and demonstrated a compromise chain that could have enabled an upstream software supply-chain attack. An authenticated command-injection flaw in an account email address allowed server-side code execution, exposing database credentials that researchers used to elevate their account to superuser and impersonate Bash maintainer Chet Ramey. They confirmed access to SSH-key controls that could grant repository push access, but did not add a key or modify repositories. Exploiting unpatched OverlayFS vulnerabilities subsequently gave them root access to the Savannah backend and access to a GNU backup server.

The researchers reported the compromise chain to the Free Software Foundation on May 11, 2026, and subsequently submitted the remaining findings. The FSF treated the incident as a full compromise, patched the kernel, addressed the application vulnerabilities, and published its incident report and Savane patches on August 7. The related Ubuntu OverlayFS flaws, CVE-2023-2640 and CVE-2023-32629, enable local privilege escalation on affected kernels and had fixes available since July 24, 2023. The findings underscore the need for repository-hosting operators to patch both applications and kernels, restrict privileged account impersonation, and audit maintainer SSH-key changes.