CVE-2026-53586
Received Received - Intake

Credential Disclosure in libgit2 HTTP Transport

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-53586
EUVD
EUVD-2026-63550

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libgit2 libgit2 to 1.8.6 (inc)
libgit2 libgit2 to 1.9.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libgit2 is a Git implementation library. Prior to versions 1.8.6 and 1.9.5, it had a flaw in its HTTP transport handling. When a Git server redirects to another URL, libgit2 incorrectly passes the original trusted URL to credential callbacks instead of the redirected URL. This can cause credentials meant for the original server to be sent to an attacker-controlled server.

Detection Guidance

To detect this vulnerability, check if your libgit2 version is below 1.8.6 or 1.9.5. Run: git2 --version or check your application's dependency files for libgit2 version. Monitor network traffic for unexpected Authorization headers sent to redirected hosts.

Impact Analysis

If you use a vulnerable version of libgit2, an attacker who controls a trusted Git host or can perform an open redirect on that host may intercept your HTTP Basic credentials, personal access tokens, or similar authentication details. This could lead to unauthorized access to your repositories or other systems using those credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing credentials that grant access to protected repositories or systems. Compliance may be impacted if credentials are compromised and used to access regulated data.

Mitigation Strategies

Immediately upgrade libgit2 to version 1.8.6 or 1.9.5 or later. Review and revoke any exposed credentials. Configure your Git hosts to avoid open redirects. Monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart