Read the docs
TI-2022-22820 Aliases CVE-2022-46176GHSA-r5w3-xm58-jv6j

Cargo did not verify SSH host keys

Priority LOW 28CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed cargo (crates.io): 0.67.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rust-langcargoup to 0.67.0—No fix listedCNA
—cargo (crates.io)before 0.67.10.67.1Patch availableGHSA-r5w3-xm58-jv6j
  • cargo Vendorrust-lang Affected up to 0.67.0 Fixed in — No fix listed CNA
  • cargo (crates.io) Vendor— Affected before 0.67.1 Fixed in 0.67.1 Patch available GHSA-r5w3-xm58-jv6j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*up to 0.67.0Vulnerablerust-lang
  • cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:* Versions up to 0.67.0 Vulnerable ·rust-lang

Remediation

  • Fix · GHSA-r5w3-xm58-jv6j cargo (crates.io) Fixed in 0.67.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46176
  2. 2026-10-03 Alias added: GHSA-r5w3-xm58-jv6j
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 5

  • TI-2022-16536 Extracting malicious crates can corrupt arbitrary files CVSS 3.1HIGH 8.1
  • TI-2023-19877 Cargo not respecting umask when extracting crate archives CVSS 3.1HIGH 7.8
  • TI-2022-16537 Extracting malicious crates can fill the file system CVSS 3.1MEDIUM 6.5
  • TI-2026-04563 Crates in third party registries can override the cached source of other crates CVSS 4.0MEDIUM 6.5
  • TI-2026-04562 Cargo can be coerced to share credentials between registries CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences