CVE-2026-54586 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The MidnightBSD Package Manager, known as mport, serves as the primary tool for software installation and system maintenance on the Midnight BSD operating system. In versions prior to 2.7.8, a significant security deficiency existed within the core library responsible for fetching package metadata and binary distributions. Specifically, the functions mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() located in libmport/fetch.c failed to enforce strict transport layer security protocols when retrieving data from remote repositories or mirror servers. This architectural oversight allowed the system to accept and process URLs that utilized unencrypted HTTP connections instead of requiring secure HTTPS communications, creating a critical vulnerability in the software supply chain integrity mechanism.
The technical flaw stems from the absence of an enforcement check using url_is_https() within these specific code paths. When a user configured mport to use a repository or mirror URL, or when dynamic mirror selection returned such URLs, the application did not validate whether the connection was encrypted. Consequently, any network-positioned attacker capable of intercepting traffic between the client and the package server could perform man-in-the-middle attacks. By exploiting this lack of encryption enforcement, an adversary can actively tamper with both the package index files and the actual binary packages being downloaded. This capability allows for sophisticated injection attacks where malicious code is inserted into legitimate software updates or where valid packages are replaced with compromised versions without triggering immediate integrity warnings from the package manager itself.
The operational impact of this vulnerability is severe, as it directly compromises the trust model upon which operating system maintenance relies. If an attacker successfully manipulates the package index, they can alter the list of available software and their associated metadata, potentially directing users to download malicious packages that appear legitimate. Furthermore, if the binary downloads are intercepted and modified, the resulting compromise extends beyond simple data theft to full remote code execution on the affected system. Since package managers typically operate with elevated privileges during installation or update processes, a successful exploitation could grant an attacker complete control over the operating system, leading to persistent backdoors, data exfiltration, or lateral movement within a network infrastructure. This aligns closely with CWE-319, which classifies cleartext transmission of sensitive information as a critical weakness, and maps to MITRE ATT&CK techniques such as T1072 Software Deployment Tools for initial access and persistence, as well as T1584 Compromise Client Binary Updates.
To mitigate this risk, administrators must upgrade the MidnightBSD system to version 2.7.8 or later, where the developers have implemented strict enforcement of HTTPS connections within the fetch functions. Until an update is applied, users should manually verify that all configured repository URLs in their mport configuration files explicitly use https:// prefixes and avoid relying on dynamic mirror selection mechanisms that might resolve to HTTP endpoints. Additionally, implementing network-level monitoring for unencrypted traffic directed at package repositories can help detect ongoing exploitation attempts. Organizations managing Midnight BSD deployments should also consider enabling additional integrity verification measures where available, such as GPG signature validation of packages, to provide a secondary layer of defense against tampered content even if the transport channel is compromised.