Log in Start free

Vulnerability · Published May 25, 2026 · Assigned by rust

CVE-2026-5222Cargo can be coerced to share credentials between registries

Low 2.3

In plain English

A low-severity security flaw in Cargo from Rust. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24chromium-rust1.96.0-r0ALPINE-CVE-2026-5222
Alpine:v3.23rust1.91.1-r2ALPINE-CVE-2026-5222
Alpine:v3.24rust1.96.0-r0ALPINE-CVE-2026-5222
Debian:12cargono fix listedDEBIAN-CVE-2026-5222
Debian:12rust-cargono fix listedDEBIAN-CVE-2026-5222
Debian:13rust-cargono fix listedDEBIAN-CVE-2026-5222
Debian:14rust-cargo0.91.0-3DEBIAN-CVE-2026-5222
Debian:12rustcno fix listedDEBIAN-CVE-2026-5222
Debian:13rustc1.85.1+dfsg1-1+deb13u1DEBIAN-CVE-2026-5222
Debian:14rustc1.95.0+dfsg1-2DEBIAN-CVE-2026-5222
Ubuntu:22.04:LTSrustcno fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustcno fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.62no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.74no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.76no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.76no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.77no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.77no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.78no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.78no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.79no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.79no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.80no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.80no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.81no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.81no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.82no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.82no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.83no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.83no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.84no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.84no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.85no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.85no fix listedUBUNTU-CVE-2026-5222
Ubuntu:25.10rustc-1.85no fix listedUBUNTU-CVE-2026-5222
Ubuntu:25.10rustc-1.88no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.89no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.89no fix listedUBUNTU-CVE-2026-5222
Ubuntu:22.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5222
Ubuntu:24.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5222
Ubuntu:25.10rustc-1.91no fix listedUBUNTU-CVE-2026-5222
Ubuntu:26.04:LTSrustc-1.91no fix listedUBUNTU-CVE-2026-5222
Ubuntu:26.04:LTSrustc-1.92no fix listedUBUNTU-CVE-2026-5222
Ubuntu:26.04:LTSrustc-1.93no fix listedUBUNTU-CVE-2026-5222

Affected products (as reported)

VendorProductVersions
Rust Cargo 1.68.0 – before 1.96.0

Weakness: CWE-647 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References