Insufficiently protected credentials in libgit2 - CVE-2026-53586

Vulnerability identifier: #VU138490

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53586

CWE-ID: CWE-522

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in the builtin HTTP transport when following an offsite redirect for the initial smart HTTP request and handling a 401 authentication challenge from the redirected server. A remote attacker can cause an initial offsite redirect from a trusted Git remote URL to disclose sensitive information.

User interaction is required to contact a trusted original URL for which the application is willing to provide credentials.

libgit2
Debian Linux
Fedora
Ubuntu
rust-pretty-git-prompt
rust-libgit2-sys
libgit2 (Ubuntu package)
rust-git-delta
rust-bat
rust-lsd
libgit2 (Debian package)
libgit2_1.9
libgit2
rust-git-interactive-rebase-tool
rust-tokei

Install security update from vendor's website.

libgit2 - update to 1.9.5
rust-pretty-git-prompt - addressed in versions 0.2.2-11.fc43, 0.2.2-11.fc44
rust-libgit2-sys - addressed in versions 0.18.7-1.el9, 0.18.7-1.el10_3, 0.18.7-1.fc43, 0.18.7-1.fc44, 0.18.7-1.fc45
libgit2 (Ubuntu package) - addressed in versions 0.19.0-2ubuntu0.4+esm2, 0.24.1-2ubuntu0.2+esm3, 0.26.0+dfsg.1-1.1ubuntu0.2+esm2, 0.28.4+dfsg.1-2ubuntu0.1+esm1, 1.1.0+dfsg.1-4.1ubuntu0.1+esm1, 1.7.2+ds-1ubuntu3.1, 1.9.1+ds-1ubuntu1.1
rust-git-delta - addressed in versions 0.19.1-7.el9, 0.19.1-7.el10_3, 0.19.1-7.fc43, 0.19.1-7.fc44
rust-bat - addressed in versions 0.26.1-2.el9, 0.26.1-3.el10_3, 0.26.1-3.fc43, 0.26.1-3.fc44
rust-lsd - addressed in versions 1.2.0-8.el9, 1.2.0-8.el10_2, 1.2.0-8.el10_3, 1.2.0-8.fc43, 1.2.0-8.fc44
libgit2 (Debian package) - update to 1.9.0+ds-2+deb13u1
libgit2_1.9 - addressed in versions 1.9.6-1.el9, 1.9.6-1.el10_3, 1.9.6-1.fc45
libgit2 - addressed in versions 1.9.6-1.fc43, 1.9.6-1.fc44
rust-git-interactive-rebase-tool - addressed in versions 2.4.1-17.fc43, 2.4.1-17.fc44
rust-tokei - addressed in versions 14.0.0-7.el9, 14.0.0-7.el10_3, 14.0.0-7.fc43, 14.0.0-7.fc44

• https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x

• Multiple vulnerabilities in libgit2
• Fedora 45 update for libgit2_1.9, rust-libgit2-sys
• Fedora 44 update for libgit2, rust-libgit2-sys
• Fedora 43 update for libgit2, rust-libgit2-sys
• Fedora EPEL 10.3 update for libgit2_1.9, rust-libgit2-sys
• Fedora EPEL 9 update for libgit2_1.9, rust-libgit2-sys
• Ubuntu update for libgit2
• Fedora EPEL 10.3 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora 44 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora 43 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora EPEL 9 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora EPEL 10.2 update for rust-lsd
• Debian update for libgit2