Read the docs
TI-2026-04562 Aliases CVE-2026-5222GHSA-p688-r7jv-fm6f

Cargo can be coerced to share credentials between registries

Priority LOW 13CWE-647Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Fixed Cargo (Rust): 1.96.0cargo (crates.io): 0.97.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustCargo1.68.0 to before 1.96.01.96.0Patch availableCNA
—cargo (crates.io)before 0.97.00.97.0Patch availableGHSA-p688-r7jv-fm6f
  • Cargo Vendorrust Affected 1.68.0 to before 1.96.0 Fixed in 1.96.0 Patch available CNA
  • cargo (crates.io) Vendor— Affected before 0.97.0 Fixed in 0.97.0 Patch available GHSA-p688-r7jv-fm6f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*1.68.0 to before 1.96.0Vulnerablerust-lang
  • cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:* Versions 1.68.0 to before 1.96.0 Vulnerable ·rust-lang

Remediation

  • Fix · CNA Cargo (Rust) Fixed in 1.96.0
  • Fix · GHSA-p688-r7jv-fm6f cargo (crates.io) Fixed in 0.97.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5222
  2. 2026-10-03 Alias added: GHSA-p688-r7jv-fm6f

References

Patch 1

Advisory 3

Other 3

  • TI-2026-65509 pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows) CVSS 3.1MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences