Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via Redirect

Medium 6.8

In plain English

A medium-severity security flaw in gitoxide from GitoxideLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rust-gix-transport	no fix listed	DEBIAN-CVE-2026-82255
Debian:14	rust-gix-transport	0.57.0-1	DEBIAN-CVE-2026-82255
Ubuntu:24.04:LTS	rust-gix-transport	no fix listed	UBUNTU-CVE-2026-82255
Ubuntu:26.04:LTS	rust-gix-transport	no fix listed	UBUNTU-CVE-2026-82255
Ubuntu:26.10	rust-gix-transport	no fix listed	UBUNTU-CVE-2026-82255

Affected products (as reported)

Vendor	Product	Versions
GitoxideLabs	gitoxide	0.25.4 – through 0.55.0

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-9857-6mw7-fq2m) vendor-advisory
VulnCheck Advisory: gitoxide 0.25.4 HTTP Credential Leak via Redirect third-party-advisory