Read the docs
TI-2026-39412 Aliases CVE-2026-54577

mport audit can inspect the wrong package when options are present

Priority LOW 10CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Fix Fixed mport (MidnightBSD): 2.7.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MidnightBSDmportbefore 2.7.82.7.8Patch availableCNA
  • mport VendorMidnightBSD Affected before 2.7.8 Fixed in 2.7.8 Patch available CNA

Remediation

  • Fix · CNA mport (MidnightBSD) Fixed in 2.7.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54577

References

Other 4

  • TI-2008-04392 The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft… CVSS 2.0HIGH 7.1
  • TI-2009-00656 The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through… CVSS 2.0HIGH 7.8
  • TI-2026-39418 mport package bundle downloads allow unsafe destination filenames CVSS 4.0HIGH 8.3
  • TI-2026-39415 mport index decompression can leave partial or corrupt index data after zstd failures CVSS 4.0HIGH 8.3
  • TI-2026-39416 mport bootstrap index fetch can continue after hash verification failure CVSS 4.0HIGH 8.3
  • TI-2026-39421 mport permits repository and package mirror fetches over insecure transport CVSS 4.0MEDIUM 6.0
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences