CVE-2026-53586 in libgit2
Summary
by MITRE • 08/20/2026
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within libgit2 prior to versions 1.8.6 and 1.9.5 represents a critical flaw in the library's HTTP transport implementation, specifically concerning how authentication credentials are handled during URL redirections. Libgit2 serves as a portable C implementation of Git core methods, providing developers with a linkable library to integrate version control functionality into custom applications. The security defect resides primarily within the source file src/libgit2/transports/http.c, where the logic governing HTTP redirects fails to properly isolate credential contexts when following offsite initial redirects. This architectural oversight allows for the leakage of sensitive authentication data under specific network conditions involving unauthorized access responses from redirected hosts.
The technical root cause involves a mismatch in URL context passed to the credential callback during an authentication challenge on a redirect target. When libgit2 encounters a 401 Unauthorized response from a host reached via an HTTP redirect, it invokes internal functions handle_remote_auth and handle_auth to retrieve credentials for the current request. However, these functions incorrectly pass transport->owner->url, which refers to the original trusted URL, rather than transport->server.url, which represents the actual redirected destination. This error occurs because the credential callback is designed with a scope that ties returned credentials specifically to the initial trusted host. By passing the wrong URL context, libgit2 prompts the application's credential provider to return credentials associated with the trusted origin, even though those credentials are subsequently sent to a completely different, potentially malicious or untrusted server via an Authorization header using HTTP Basic authentication scheme.
The operational impact of this vulnerability is significant for any organization relying on libgit2 for secure repository interactions. An attacker who controls a Git host that performs redirects, or one capable of exploiting open redirect vulnerabilities within such a trusted environment, can trick the client into transmitting sensitive credentials to an unauthorized endpoint. This disclosure affects HTTP Basic credentials, personal access tokens, and other equivalent authentication mechanisms stored in transport->server.cred. Since these credentials are transmitted as part of standard HTTP headers without proper scoping validation against the actual destination host, attackers can intercept or capture them through man-in-the-middle attacks on the redirected path, leading to unauthorized access to source code repositories and potential compromise of associated development infrastructure.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, as it results in the unintended disclosure of sensitive authentication data. It also relates to CWE-643: Improper Mitigation for X-Path Injection or similar logic errors where input validation fails to account for state changes during redirection, though more accurately it fits CWE-529: Access Control Bypass Using an Alternate Path or Channel due to the failure to restrict credential usage to the intended host. In terms of adversary tactics, this flaw facilitates Credential Access techniques described in MITRE ATT&CK, specifically T1078: Valid Accounts and potentially T1043: Shared Web Server if used in conjunction with other exploitation vectors, allowing attackers to harvest valid credentials that can be replayed against the original service.
Mitigation for this vulnerability requires an immediate upgrade of libgit2 to version 1.8.6 or later, where the logic has been corrected to ensure transport->server.url is passed correctly during authentication challenges on redirected hosts. For applications unable to update immediately, developers should implement strict URL validation within their custom credential callbacks to verify that the requested host matches the expected trusted domain before returning any credentials. Additionally, organizations should audit their use of HTTP redirects in Git operations and consider disabling automatic redirections where possible or implementing allowlists for permitted redirect targets to prevent exploitation by attackers controlling open redirect endpoints on otherwise trusted hosts.