Use of Non-Canonical URL Paths for Authorization Decisions in Cargo - CVE-2026-5222

Vulnerability identifier: #VU132308

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5222

CWE-ID: CWE-647

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to use of non-canonical URL paths for authorization decisions. A remote attacker can force the affected application to share credentials between registries.

Cargo
Fedora
rust-cargo-util-terminal
rust-anstyle-progress
rust-cargo-util
rust-cargo-credential-libsecret
rust-rustfix
rust-cargo-c
rust-cargo-util-schemas
rust-crates-io
rust-cargo
rust-anstyle-hyperlink
rust
Open SDK for Rust on AIX

Install updates from vendor's website.

Cargo - update to 0.97.0
rust-cargo-util-terminal - addressed in versions 0.1.0-1.el10_3, 0.1.0-1.fc44, 0.1.0-1.fc45, 0.1.0-1.fc46
rust-anstyle-progress - addressed in versions 0.1.4-1.el10_3, 0.1.4-1.fc44, 0.1.4-1.fc45, 0.1.4-1.fc46
rust-cargo-util - addressed in versions 0.2.30-1.el10_3, 0.2.30-1.fc44, 0.2.30-1.fc45, 0.2.30-1.fc46
rust-cargo-credential-libsecret - addressed in versions 0.5.8-1.el10_3, 0.5.8-1.fc44, 0.5.8-1.fc45, 0.5.8-1.fc46
rust-rustfix - addressed in versions 0.9.7-1.el10_3, 0.9.7-1.fc44, 0.9.7-1.fc45, 0.9.7-1.fc46
rust-cargo-c - addressed in versions 0.10.24-1.el10_3, 0.10.24-1.fc44, 0.10.24-1.fc45, 0.10.24-1.fc46
rust-cargo-util-schemas - addressed in versions 0.14.1-1.el10_3, 0.14.1-1.fc44, 0.14.1-1.fc45, 0.14.1-1.fc46
rust-crates-io - addressed in versions 0.41.0-1.el10_3, 0.41.0-1.fc44, 0.41.0-1.fc45, 0.41.0-1.fc46
rust-cargo - addressed in versions 0.98.0-1.el10_3, 0.98.0-1.fc44, 0.98.0-1.fc45, 0.98.0-1.fc46
rust-anstyle-hyperlink - addressed in versions 1.0.2-1.el10_3, 1.0.2-1.fc44, 1.0.2-1.fc45, 1.0.2-1.fc46
Open SDK for Rust on AIX - addressed in versions 1.92 Fix Pack 3, 1.94 Fix Pack 1
rust - addressed in versions 1.96.0-1.fc43, 1.96.0-1.fc44

• https://github.com/rust-lang/cargo/security/advisories/GHSA-p688-r7jv-fm6f

• Multiple vulnerabilities in Cargo
• Fedora 44 update for rust
• Fedora 43 update for rust
• Multiple vulnerabilities in IBM Open SDK for Rust on AIX
• Fedora 46 update for rust-anstyle-hyperlink, rust-anstyle-progress, rust-cargo, rust-cargo-c, rust-cargo-credential-libsecret, rust-cargo-util, rust-cargo-util-schemas, rust-cargo-util-terminal, rust-crates-io, rust-rustfix
• Fedora 45 update for rust-anstyle-hyperlink, rust-anstyle-progress, rust-cargo, rust-cargo-c, rust-cargo-credential-libsecret, rust-cargo-util, rust-cargo-util-schemas, rust-cargo-util-terminal, rust-crates-io, rust-rustfix
• Fedora 44 update for rust-anstyle-hyperlink, rust-anstyle-progress, rust-cargo, rust-cargo-c, rust-cargo-credential-libsecret, rust-cargo-util, rust-cargo-util-schemas, rust-cargo-util-terminal, rust-crates-io, rust-rustfix
• Fedora EPEL 10.3 update for rust-anstyle-hyperlink, rust-anstyle-progress, rust-cargo, rust-cargo-c, rust-cargo-credential-libsecret, rust-cargo-util, rust-cargo-util-schemas, rust-cargo-util-terminal, rust-crates-io, rust-rustfix