CVE-2026-5222
Cargo Registry URL Normalization Issue Leading to Credential Exposure
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: rust
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rust-lang | cargo | From 1.68 (inc) to 1.96 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-647 | The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Cargo versions between 1.68 and 1.96, where the software incorrectly normalizes URLs of third-party registries using the sparse index protocol.
If a hosting provider allows multiple registries with arbitrary names under the same domain, an attacker who can publish crates in one registry could potentially obtain the credentials of other users of that same registry.
The vulnerability is considered low severity due to the very specific and niche conditions required to exploit it.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker who has publishing rights in a registry to steal credentials of other users within that registry.
This could lead to unauthorized access to user accounts or resources associated with those credentials.
However, the impact is limited by the low severity rating and the very specific conditions needed to carry out the attack.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker who can publish crates in a registry to obtain the credentials of other users of the same registry under certain niche conditions.
Such unauthorized credential access could potentially lead to unauthorized data access or disclosure, which may impact compliance with data protection regulations like GDPR or HIPAA if sensitive personal or health information is involved.
However, the severity of the vulnerability is rated as low due to the extremely niche requirements needed to achieve the attack, which may limit its practical impact on compliance.