Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M
CVE-2026-53586libgit2: HTTP transport can leak credentials to an offsite redirect target
Medium 6.5
In plain English
A medium-severity information exposure in libgit2 from libgit2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | libgit2 | 1.9.6-r0 | ALPINE-CVE-2026-53586 |
| Alpine:v3.24 | libgit2 | 1.9.6-r0 | ALPINE-CVE-2026-53586 |
| Debian:12 | libgit2 | 1.5.1+ds-1+deb12u2 | DEBIAN-CVE-2026-53586 |
| Debian:13 | libgit2 | 1.9.0+ds-2+deb13u1 | DEBIAN-CVE-2026-53586 |
| Debian:14 | libgit2 | 1.9.6+ds-1 | DEBIAN-CVE-2026-53586 |
| Ubuntu:24.04:LTS | libgit2 | 1.7.2+ds-1ubuntu3.1 | UBUNTU-CVE-2026-53586 |
| Ubuntu:26.04:LTS | libgit2 | 1.9.1+ds-1ubuntu1.1 | UBUNTU-CVE-2026-53586 |
Affected products (as reported)
Weakness: CWE-200, CWE-522, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x x_refsource_CONFIRM
- https://github.com/libgit2/libgit2/commit/07de6a7e438f95ac9a6efd3222a82117e871ed27 x_refsource_MISC
- https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b x_refsource_MISC
- https://github.com/libgit2/libgit2/commit/c1507abc44647b3acd832a33a5b1c8c9f5ba8821 x_refsource_MISC
- https://github.com/libgit2/libgit2/releases/tag/v1.8.6 x_refsource_MISC
- https://github.com/libgit2/libgit2/releases/tag/v1.9.5 x_refsource_MISC