CVE-2026-53586: 
Bat vulnerability analysis and mitigation

CVE-2026-53586 is a credential leakage vulnerability in libgit2's HTTP transport layer, where the library follows offsite redirects for initial smart HTTP requests and subsequently sends credentials scoped to the original trusted URL to the redirect target. It affects libgit2 version 1.9.0 (specifically at commit 57877524482fe6e46afdbf636f5467e7f9a33fe5) and the Rust libgit2-sys bindings on Linux/Unix platforms. The vulnerability was discovered by Thai Son Dinh from VinSOC Labs (R&D) and published as a GitHub Security Advisory on July 18, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Ubuntu Advisory).

The root cause lies in libgit2's HTTP transport implementation, which passes the original remote URL — rather than the redirected URL — to the application's credential callback after an offsite redirect triggers a 401 Unauthorized response (CWE-200, CWE-522, CWE-601). Specifically, handle_remote_auth in src/libgit2/transports/http.c calls the credential callback with transport->owner->url (the original URL), while subsequent requests are sent to the redirected host with the acquired credential attached as an Authorization header. By default, GIT_REMOTE_REDIRECT_INITIAL permits offsite redirects for the initial smart HTTP request, and while scheme downgrade (e.g., HTTPS-to-HTTP) is mitigated, HTTPS-to-HTTPS offsite redirects remain exploitable. A public proof-of-concept demonstrating the leak using two local loopback HTTP servers is included in the advisory (GitHub Advisory).

Successful exploitation allows an attacker to capture HTTP Basic credentials, personal access tokens, or other GIT_CREDENTIAL_USERPASS_PLAINTEXT-style credentials that an application provides for a trusted Git remote URL. The leaked credentials are sent as an Authorization header to an attacker-controlled redirect target, potentially enabling account takeover, unauthorized repository access, or lateral movement within CI/CD pipelines and developer environments. The confidentiality impact is high, while integrity and availability are not directly affected (GitHub Advisory, Ubuntu Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating the credential leak using local loopback HTTP and HTTPS servers. Exploitation requires user interaction — specifically, a victim application must initiate a fetch or connection to a Git remote URL that an attacker can cause to redirect offsite, such as through a compromised Git host or an open redirect on a trusted domain. No evidence of in-the-wild exploitation or threat actor attribution has been reported at this time. The CVE status was initially listed as "Reserved" with no patch available at time of disclosure, though distribution-level fixes have since been issued (GitHub Advisory, Ubuntu Advisory).

1. Set up a malicious redirect server: Deploy an HTTP or HTTPS server at an attacker-controlled host that returns a 302 redirect from the original trusted Git remote URL (e.g., http://trusted-git-host/repo.git) to an offsite target (e.g., http://attacker-host/redirected.git).
2. Trigger the redirect: Cause the victim application using libgit2 to initiate a smart HTTP fetch or connection to the original trusted URL — for example, by compromising the trusted Git server or exploiting an open redirect on a trusted host.
3. Issue a 401 challenge from the redirect target: Configure the attacker-controlled redirect target to respond with 401 Unauthorized and a WWW-Authenticate: Basic header after receiving the redirected request.
4. Capture the credential: libgit2 calls the application's credential callback with the original trusted URL (not the redirected URL). If the callback is scoped to the original URL, it returns credentials (e.g., victim-user:victim-pass). libgit2 then attaches these as an Authorization: Basic <base64> header on the next request to the attacker-controlled redirect target.
5. Collect the leaked credentials: The attacker's server logs the Authorization header, recovering the plaintext username and password or access token for the original trusted Git service (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from a libgit2-consuming application to unfamiliar hosts following a Git remote operation; Authorization: Basic headers observed in traffic to hosts other than the configured Git remote.
• Logs: HTTP access logs on Git servers showing 302 redirects to external/offsite URLs during git-upload-pack advertisement requests (/info/refs?service=git-upload-pack); application logs showing credential callback invocations followed by connection to a different host.
• Process/Application: libgit2-based tools (e.g., git, Rust applications using libgit2-sys, CI/CD agents) making network connections to unexpected hosts during repository fetch or clone operations.

Ubuntu has released patched package versions addressing CVE-2026-53586: Ubuntu 26.04 LTS (libgit2-1.9 1.9.1+ds-1ubuntu1.1), Ubuntu 24.04 LTS (libgit2-1.7 1.7.2+ds-1ubuntu3.1), and Ubuntu 22.04/20.04/18.04 LTS via Ubuntu Pro ESM Apps. Fedora has also issued updates for rust-libgit2-sys. As a workaround, applications can configure their credential callbacks to decline requests for any URL that does not exactly match the expected remote URL, preventing credentials from being returned for unexpected hosts. Additionally, disabling offsite redirects by overriding the GIT_REMOTE_REDIRECT_INITIAL setting in libgit2 configuration, if exposed by the consuming application, would mitigate the issue. Upstream libgit2 had no patch available at the time of initial disclosure; users should apply distribution-provided updates promptly (Ubuntu Advisory, GitHub Advisory).

The vulnerability was credited to Thai Son Dinh from VinSOC Labs (R&D) and published via GitHub's security advisory process. Multiple Linux distributions including Ubuntu, openSUSE, Fedora, and Debian have issued advisories and package updates. Security scanning platforms Qualys and Tenable/Nessus have added detection plugins for this CVE. Coverage has appeared on LinuxSecurity.com, LinuxCompatible.org, and Pro-Linux.de, reflecting broad community awareness across the open-source ecosystem (Ubuntu Advisory, GitHub Advisory).