Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Rust package manager may expose other users' credentials
published 5 months ago
Summary
The Rust package manager (Cargo) can mishandle the web addresses of third‑party code repositories when they use a specific indexing method. If a hosting service lets many registries share the same domain with custom names, an attacker who can add packages could steal other users' login details. To protect yourself, use a hosting provider that separates registries by domain or disables the sparse index feature, and keep Cargo updated to a version newer than 1.96.
What to do
- Update azure rust to version 1.90.0-9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | rust |
>= 1.85.0, < 1.90.0-9 Fix: upgrade to 1.90.0-9
|
Original advisory text
CVE-2026-5222 affecting package rust for versions less than 1.90.0-9
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
References
Timeline
Published25 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-88281 · OSV
Track software like this
Free during beta