CVE-2026-62960
Received Received - Intake

Git for Windows NTLM Credential Leak via Malicious Bundle URI

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62960
EUVD
EUVD-2026-64126

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
git_for_windows git 2.55.0.windows.4
git git 2.55.0.windows.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-610 The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62960 is a vulnerability in Git for Windows where a malicious remote Git server can advertise a bundle URI that causes the client to initiate an outbound SMB connection during clone or fetch operations. This happens when the transfer.bundleuri setting is enabled. The server can use non-HTTP(S) URIs like UNC paths or file URIs, which Git incorrectly treats as local paths, leading Windows to connect to an attacker-controlled share and expose NTLM authentication credentials.

Detection Guidance

Check if transfer.bundleuri is enabled in your Git configuration by running: git config --global --get transfer.bundleuri. If enabled, verify if any recent git clone or fetch operations initiated unexpected SMB connections by monitoring network traffic with tools like Wireshark or Windows Resource Monitor.

Impact Analysis

If you use Git for Windows with transfer.bundleuri=true and fetch from an untrusted remote server, an attacker could trick your system into connecting to a malicious SMB share. This may expose your NTLM authentication credentials, which could be captured and potentially brute-forced to recover your password. The impact is limited to systems with the vulnerable setting enabled and where untrusted remotes are used.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by exposing NTLM authentication credentials during SMB connections initiated by Git operations. Credential exposure may lead to unauthorized access to sensitive data, violating confidentiality requirements in these regulations.

Mitigation Strategies

Upgrade Git for Windows to version 2.55.0.windows.4 or later. Disable transfer.bundleuri by running: git config --global transfer.bundleuri false. Avoid cloning from untrusted remotes until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart