CVE-2026-53586
Publication date 31 July 2026
Last updated 2 September 2026
Ubuntu priority
Description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libgit2 | 26.04 LTS resolute |
Fixed 1.9.1+ds-1ubuntu1.1
|
| 24.04 LTS noble |
Fixed 1.7.2+ds-1ubuntu3.1
|
|
| 22.04 LTS jammy |
Fixed 1.1.0+dfsg.1-4.1ubuntu0.1+esm1
|
|
| 20.04 LTS focal |
Fixed 0.28.4+dfsg.1-2ubuntu0.1+esm1
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
6.5 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8628-1
- libgit2 vulnerabilities
- 12 August 2026