CVE-2026-82255 in Gitoxide
Summary
by MITRE • 08/28/2026
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The gitoxide library versions ranging from 0.25.4 are affected by a critical HTTP credential leak vulnerability within its curl-based transport backend. This security flaw stems from an improper handling of Uniform Resource Locators during the process of following HTTP redirects, specifically when interacting with remote repositories or other network resources that require authentication. The core technical deficiency lies in how the library validates and attaches credentials to outgoing requests. Instead of re-evaluating the target URL after a redirect has occurred, gitoxide continues to use the original request's context for credential attachment decisions. This architectural oversight means that if an attacker can manipulate or control the server responding to a Git operation, they can engineer scenarios where authentication tokens are inadvertently transmitted to unauthorized destinations.
The operational mechanism of this vulnerability relies on standard HTTP redirection behaviors. When a client initiates a connection and receives a redirect response code such as 301 Moved Permanently or 302 Found, the curl backend in gitoxide proceeds with the new location without resetting its credential attachment logic appropriately relative to the new domain. Consequently, if an attacker controls a server that issues these redirects, they can trick the client into sending sensitive authentication tokens, including personal access tokens or SSH keys passed via URL parameters, to their controlled infrastructure. This is particularly dangerous in scenarios involving cross-domain redirects where the original request was intended for a trusted repository host but ends up at a malicious endpoint under attacker control.
Furthermore, this vulnerability facilitates HTTPS-to-HTTP downgrade attacks which significantly exacerbate the risk of credential theft. If an initial secure connection is redirected to an insecure HTTP endpoint on a different domain, gitoxide may still attach credentials that were meant only for the original secure context. Since HTTP transmits data in plaintext, any attacker performing man-in-the-middle operations or controlling the final redirect target can easily intercept and exfiltrate these tokens. This undermines the fundamental security guarantees provided by HTTPS and exposes users to account compromise if they reuse passwords or tokens across different services. The flaw effectively bypasses same-origin policies that developers might assume are enforced at the application layer, as the underlying HTTP client library handles the transport without sufficient domain validation for credential attachment.
From a classification perspective, this vulnerability aligns with CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-384 Session Fixation through improper handling of session identifiers during redirects. In terms of adversary tactics, it maps directly to ATT&CK technique T1557 Adversary-in-the-Middle, as the vulnerability allows for credential interception via redirect manipulation. It also relates to T1071 Application Layer Protocol abuse, where standard HTTP features are weaponized against security controls. The impact is severe because Git credentials often provide write access to source code repositories, potentially allowing attackers to inject malicious code, steal intellectual property, or establish persistent backdoors within software supply chains.
Mitigation strategies must focus on immediate updates and configuration hardening. Users of gitoxide should upgrade to a version that has patched this redirect handling logic, ensuring that credential attachment is strictly bound to the effective URL after all redirects are resolved rather than the initial request target. Developers integrating gitoxide into larger applications should verify their dependency versions through automated security scanning tools like Snyk or Dependabot. Additionally, organizations should enforce strict HTTPS policies and disable HTTP fallbacks where possible to prevent downgrade attacks. Implementing Content Security Policy headers on any web-facing Git servers can also help mitigate the impact by restricting which domains are allowed to receive credentials via redirects. Regular audits of network traffic logs for unusual redirect patterns involving authentication endpoints can aid in early detection of exploitation attempts targeting this specific flaw.