Insufficiently protected credentials in git-lfs - CVE-2026-69261
Published: October 27, 2026
Vulnerability identifier: #VU158063
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69261
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive cookies and potentially gain unauthorized access using exposed credentials.
The vulnerability exists due to insufficient protection of credentials in Git LFS HTTP redirect handling when forwarding headers to a different host. A remote attacker can exploit a redirect to a host under their control to receive cookies intended for another host and potentially use exposed credentials to gain unauthorized access.
Authorization headers are not forwarded to inappropriate hosts; Cookie headers may be forwarded incorrectly.
Affected software
git-lfs
How to mitigate CVE-2026-69261
Install security update from vendor's website.
git-lfs - update to 3.8.1