CVE-2026-82255
Deferred Deferred - Pending Action

HTTP Credential Leak in gitoxide via Redirect

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-18
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-82255
EUVD
EUVD-2026-67581

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitoxide gitoxide 0.25.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in gitoxide versions 0.25.4 involves an HTTP credential leak through the curl-based transport backend. Credentials are sent to attacker-controlled servers after HTTP redirects because the system checks the original URL instead of the effective URL post-redirect. This allows attackers to steal authentication tokens via cross-domain redirects or HTTPS-to-HTTP downgrades.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected HTTP redirects involving gitoxide operations. Check for credentials being sent to unintended domains after redirects. Review logs for any HTTPS-to-HTTP downgrades during git operations.

Impact Analysis

Attackers could steal your authentication tokens, gaining unauthorized access to repositories or sensitive data. This could lead to data breaches, unauthorized code changes, or exposure of private information stored in git repositories.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update gitoxide to a version later than 0.25.4. Disable the curl-based transport backend if not required. Configure firewalls to block unexpected redirects and enforce HTTPS-only connections for git operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart