Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Cargo 1.68‑1.96 may expose other users’ credentials

CVE-2026-5222 · published 5 months ago
Summary

Versions of Cargo between 1.68 and 1.96 can mishandle the web addresses of third‑party package registries. If a provider hosts multiple registries under the same domain, a malicious publisher could steal the login details of other users of that registry. Update Cargo to a newer version or ensure registries are hosted on separate domains to prevent this risk.

What to do
  • Update bellsoft rust to version 1.96.0-r0.
  • Update rust-lang-owner cargo to version 0.97.0.
  • Update alpine rust to version 1.91.1-r2.
  • Update debian rust-cargo to version 0.91.0-3.
  • Update debian rustc to version 1.85.1+dfsg1-1+deb13u1.
  • Update debian rustc to version 1.95.0+dfsg1-2.
Affected software
Ecosystem VendorProductAffected versions
Debian:14 debian rustc < 1.95.0+dfsg1-2
Fix: upgrade to 1.95.0+dfsg1-2
Ubuntu:Pro:14.04:LTS canonical rustc All versions
Ubuntu:Pro:16.04:LTS canonical cargo All versions
Ubuntu:Pro:16.04:LTS canonical rustc All versions
Ubuntu:Pro:18.04:LTS canonical cargo All versions
Ubuntu:Pro:18.04:LTS canonical rustc All versions
Ubuntu:Pro:20.04:LTS canonical cargo All versions
Ubuntu:Pro:20.04:LTS canonical rustc All versions
Ubuntu:Pro:20.04:LTS canonical rustc-1.76 All versions
Ubuntu:Pro:20.04:LTS canonical rustc-1.77 All versions
Ubuntu:Pro:20.04:LTS canonical rustc-1.78 All versions
Ubuntu:Pro:20.04:LTS canonical rustc-1.79 All versions
Ubuntu:Pro:20.04:LTS canonical rustc-1.80 All versions
Ubuntu:22.04:LTS canonical rustc All versions
Ubuntu:22.04:LTS canonical rustc-1.62 All versions
Ubuntu:22.04:LTS canonical rustc-1.76 All versions
Ubuntu:22.04:LTS canonical rustc-1.77 All versions
Ubuntu:22.04:LTS canonical rustc-1.78 All versions
Ubuntu:22.04:LTS canonical rustc-1.79 All versions
Ubuntu:22.04:LTS canonical rustc-1.80 All versions
Ubuntu:22.04:LTS canonical rustc-1.81 All versions
Ubuntu:22.04:LTS canonical rustc-1.82 All versions
Ubuntu:22.04:LTS canonical rustc-1.83 All versions
Ubuntu:22.04:LTS canonical rustc-1.84 All versions
Ubuntu:22.04:LTS canonical rustc-1.85 All versions
Ubuntu:22.04:LTS canonical rustc-1.89 All versions
Ubuntu:22.04:LTS canonical rustc-1.91 All versions
Ubuntu:Pro:22.04:LTS canonical cargo All versions
Ubuntu:24.04:LTS canonical rustc All versions
Ubuntu:24.04:LTS canonical rustc-1.74 All versions
Ubuntu:24.04:LTS canonical rustc-1.76 All versions
Ubuntu:24.04:LTS canonical rustc-1.77 All versions
Ubuntu:24.04:LTS canonical rustc-1.78 All versions
Ubuntu:24.04:LTS canonical rustc-1.79 All versions
Ubuntu:24.04:LTS canonical rustc-1.80 All versions
Ubuntu:24.04:LTS canonical rustc-1.81 All versions
Ubuntu:24.04:LTS canonical rustc-1.82 All versions
Ubuntu:24.04:LTS canonical rustc-1.83 All versions
Ubuntu:24.04:LTS canonical rustc-1.84 All versions
Debian:11 debian cargo All versions
Debian:12 debian cargo All versions
Debian:11 debian rust-cargo All versions
Debian:12 debian rust-cargo All versions
Debian:13 debian rust-cargo All versions
Debian:14 debian rust-cargo < 0.91.0-3
Fix: upgrade to 0.91.0-3
Alpaquita:23 bellsoft rust >= 1.64.0-r1
Alpaquita:25 bellsoft rust >= 1.87.0-r1
Alpaquita:stream bellsoft rust >= 1.69.0-r10, < 1.96.0-r0
Fix: upgrade to 1.96.0-r0
Debian:11 debian rustc All versions
Debian:12 debian rustc All versions
Showing 50 of 62. Show the rest
Ecosystem VendorProductAffected versions
Debian:13 debian rustc < 1.85.1+dfsg1-1+deb13u1
Fix: upgrade to 1.85.1+dfsg1-1+deb13u1
Ubuntu:24.04:LTS canonical rustc-1.85 All versions
Ubuntu:24.04:LTS canonical rustc-1.89 All versions
Ubuntu:24.04:LTS canonical rustc-1.91 All versions
Ubuntu:25.10 canonical rustc-1.85 All versions
Ubuntu:25.10 canonical rustc-1.88 All versions
Ubuntu:25.10 canonical rustc-1.91 All versions
Ubuntu:26.04:LTS canonical rustc-1.91 All versions
Ubuntu:26.04:LTS canonical rustc-1.92 All versions
Ubuntu:26.04:LTS canonical rustc-1.93 All versions
rust rust-lang-owner cargo < 0.97.0
Fix: upgrade to 0.97.0
Alpine:v3.23 alpine rust < 1.91.1-r2
Fix: upgrade to 1.91.1-r2
Original advisory text
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary ...
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-647Use of Non-Canonical URL Paths for Authorization Decisions
Timeline
Published25 May 2026
Updated4 Nov 2026
First seen26 May 2026
Sources
DEBIAN-CVE-2026-5222 · OSV
BELL-CVE-2026-5222 · OSV
ALPINE-CVE-2026-5222 · OSV
UBUNTU-CVE-2026-5222 · OSV
CVE-2026-5222 · NVD
GHSA-p688-r7jv-fm6f · GHSA
GHSA-p688-r7jv-fm6f · OSV
Track software like this
Free during beta