Loading vulnerability…
Credential Disclosure via Offsite HTTP Redirects in libgit2
CVE-2026-53586 is a credential-disclosure vulnerability in libgit2's built-in HTTP transport, fixed in the 1.8 and 1.9 release lines by versions 1.8.6 and 1.9.5, respectively. After following an initial smart-HTTP redirect to another host, handle_remote_auth and handle_auth supply the original remote URL rather than the current destination URL to the application's credential callback when the destination returns HTTP 401 Unauthorized. A callback that correctly scopes credentials to the original trusted URL may consequently return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores and transmits to the redirected host in an Authorization header. An attacker controlling the original trusted Git host or an open redirect on it can exploit this behavior to obtain credentials intended for that host.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation discloses HTTP Basic credentials, personal access tokens, or equivalent credentials to an offsite redirect target. Stolen credentials may permit subsequent unauthorized access to repositories or other resources, depending on their privileges and scope. The direct impact is loss of confidentiality; this vulnerability does not itself establish code execution, data modification, or denial of service.
If you can’t patch tonight, do this now.
Until upgrades are deployed, prevent or restrict cross-origin redirects for Git HTTP remotes where possible. Credential callbacks should independently validate the current authentication target and must not return credentials solely because the original remote URL is trusted; credentials should be restricted to the intended scheme, host, and port.
Patch, then assume compromise.
Upgrade libgit2 to version 1.8.6 or later in the 1.8 release line, version 1.9.5 or later in the 1.9 release line, or a distribution package containing the backported fix. The correction supplies the current destination URL to the authentication callback instead of the original remote URL. Fixed Debian packages include 1.5.1+ds-1+deb12u2 for Debian 12 and 1.9.0+ds-2+deb13u1 for Debian 13. Update applications that statically bundle libgit2 as well as the system library; affected Rust application rebuilds replace vulnerable bundled copies with linkage to the patched system library.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.