{"id":"CVE-2026-5222","aliases":["ALPINE-CVE-2026-5222","AZL-88275","AZL-88281","BELL-CVE-2026-5222","DEBIAN-CVE-2026-5222","EUVD-2026-31654","GHSA-p688-r7jv-fm6f","UBUNTU-CVE-2026-5222"],"status":"published","title":"Cargo can be coerced to share credentials between registries","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00478,"percentile":0.41566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-647"],"published":"2026-05-25T08:54:56Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"crates.io","package":"cargo","fixed_in":["0.97.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.96.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rust","fixed_in":["1.91.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.96.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-30","1.90.0-9"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rust","fixed_in":["1.64.0-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rust","fixed_in":["1.87.0-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rust","fixed_in":["1.96.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-cargo","fixed_in":["0.91.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rustc","fixed_in":["1.85.1+dfsg1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rustc","fixed_in":["1.95.0+dfsg1-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.64.0-r1"},{"fixed":"1.64.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.87.0-r1"},{"fixed":"1.87.0-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.69.0-r10"},{"fixed":"1.96.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.66.0+ds1-1","0.66.0+ds2-1","0.66.0+ds2-2","0.70.1+ds1-1","0.70.1+ds1-1~exp1","0.70.1+ds1-2","0.70.1+ds1-3","0.70.1-1~exp1"]},{"source":"osv","ecosystem":"Debian:12","package":"rust-cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.66.0-1","0.66.0-2","0.66.0-3","0.66.0-4","0.66.0-5","0.66.0-6","0.70.1-1","0.70.1-2","0.70.1-3","0.76.0-1","0.76.0-2","0.76.0-3","0.76.0-4","0.81.0-1","0.81.0-2","0.81.0-3","0.82.0-1","0.83.0-1","0.83.0-2","0.84.0-1","0.85.0-1","0.86.0-1","0.86.0-2","0.86.0-3","0.86.0-4","0.91.0-1","0.91.0-2","0.91.0-3","0.91.0-4","0.91.0-5","0.96.0-1","0.96.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.86.0-2","0.86.0-3","0.86.0-4","0.91.0-1","0.91.0-2","0.91.0-3","0.91.0-4","0.91.0-5","0.96.0-1","0.96.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.91.0-3"}]}],"versions":["0.86.0-2","0.86.0-3","0.86.0-4","0.91.0-1","0.91.0-2"]},{"source":"osv","ecosystem":"Debian:12","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.63.0+dfsg1-2","1.64.0+dfsg1-1","1.64.0+dfsg1-1~exp1","1.64.0+dfsg1-1~exp2","1.64.0+dfsg1-1~exp3","1.64.0+dfsg1-1~exp4","1.65.0+dfsg1-1","1.65.0+dfsg1-1~exp1","1.65.0+dfsg1-1~exp2","1.65.0+dfsg1-1~exp3","1.65.0+dfsg1-2","1.66.0+dfsg1-1","1.66.0+dfsg1-1~exp1","1.67.1+dfsg1-1","1.67.1+dfsg1-1~exp1","1.68.2+dfsg1-1","1.68.2+dfsg1-1~exp1","1.69.0+dfsg1-1","1.69.0+dfsg1-1~exp1","1.69.0+dfsg1-1~exp2","1.70.0+dfsg1-1","1.70.0+dfsg1-1~exp1","1.70.0+dfsg1-1~exp2","1.70.0+dfsg1-1~exp3","1.70.0+dfsg1-2","1.70.0+dfsg1-2~exp1","1.70.0+dfsg1-3","1.70.0+dfsg1-4","1.70.0+dfsg1-5","1.70.0+dfsg1-6","1.70.0+dfsg1-7","1.70.0+dfsg1-8","1.70.0+dfsg1-8.1","1.70.0+dfsg1-9","1.70.0+dfsg2-1","1.70.0+dfsg2-1+loong64","1.70.0+dfsg2-1~exp1","1.70.0+dfsg2-1~exp2","1.70.0+dfsg2-1~exp3","1.71.1+dfsg1-1","1.71.1+dfsg1-1~exp1","1.71.1+dfsg1-1~exp2","1.71.1+dfsg1-2","1.72.1+dfsg1-1","1.72.1+dfsg1-1+hurd.1","1.72.1+dfsg1-1~exp1","1.72.1+dfsg1-1~exp2","1.73.0+dfsg1-1","1.73.0+dfsg1-1+hurd.1","1.73.0+dfsg1-1+loong64","1.73.0+dfsg1-1~exp1","1.74.1+dfsg1-1","1.74.1+dfsg1-1+hurd.1","1.74.1+dfsg1-1~exp1","1.75.0+dfsg1-1","1.75.0+dfsg1-1~exp1","1.75.0+dfsg1-2","1.75.0+dfsg1-3","1.75.0+dfsg1-4","1.75.0+dfsg1-4+hurd.1","1.75.0+dfsg1-5","1.76.0+dfsg1-1","1.76.0+dfsg1-1+hurd.1","1.76.0+dfsg1-1~exp1","1.77.2+dfsg1-1","1.77.2+dfsg1-1~exp1","1.78.0+dfsg1-1~exp1","1.78.0+dfsg1-2","1.79.0+dfsg1-1","1.79.0+dfsg1-1~exp1","1.79.0+dfsg1-2","1.79.0+dfsg1-2+hurd.1","1.80.0+dfsg1-1~exp1","1.80.1+dfsg1-1","1.80.1+dfsg1-1+hurd.1","1.80.1+dfsg1-1~exp1","1.81.0+dfsg1-1","1.81.0+dfsg1-1~exp1","1.81.0+dfsg1-1~exp2","1.81.0+dfsg1-2","1.82.0+dfsg1-1","1.82.0+dfsg1-1~exp1","1.82.0+dfsg1-1~exp2","1.82.0+dfsg1-1~exp3","1.82.0+dfsg1-2","1.83.0+dfsg1-1","1.83.0+dfsg1-1~exp1","1.84.0+dfsg1-1","1.84.0+dfsg1-1~exp1","1.84.0+dfsg1-2","1.85.0+dfsg1-1","1.85.0+dfsg2-1","1.85.0+dfsg2-2","1.85.0+dfsg2-3","1.85.0+dfsg3-1","1.85.0~beta.9+dfsg1-1~exp1","1.86.0+dfsg1-1","1.86.0+dfsg1-1~bpo13+1","1.86.0+dfsg1-1~bpo13+2","1.86.0+dfsg1-1~exp1","1.86.0+dfsg1-1~exp2","1.86.0+dfsg1-1~exp2+x32","1.86.0+dfsg1-1~exp3","1.86.0+dfsg1-1~exp4","1.87.0+dfsg1-1","1.87.0+dfsg1-1~bpo13+1","1.87.0+dfsg1-1~bpo13+2","1.87.0+dfsg1-1~exp1","1.88.0+dfsg1-1","1.88.0+dfsg1-1~exp1","1.88.0+dfsg1-2","1.88.0+dfsg1-2~bpo13+1","1.89.0+dfsg1-1","1.89.0+dfsg1-1~bpo13+1","1.89.0+dfsg1-1~bpo13+2","1.89.0+dfsg1-1~exp1","1.90.0+dfsg1-1","1.90.0+dfsg1-1~bpo13+1","1.90.0+dfsg1-1~bpo13+2","1.90.0+dfsg1-1~exp1","1.91.1+dfsg1-1","1.91.1+dfsg1-1~bpo13+1","1.91.1+dfsg1-1~bpo13+2","1.91.1+dfsg1-1~exp1","1.91.1+dfsg1-1~exp2","1.91.1+dfsg1-1~exp3","1.92.0+dfsg1-1","1.92.0+dfsg1-1~exp1","1.92.0+dfsg1-2","1.92.0+dfsg1-2~bpo13+1","1.93.1+dfsg1-1","1.93.1+dfsg1-1~exp1","1.93.1+dfsg1-2","1.93.1+dfsg1-2~bpo13+1","1.94.1+dfsg1-1","1.94.1+dfsg1-1~bpo13+1","1.94.1+dfsg1-1~bpo13+2","1.94.1+dfsg1-1~bpo13+3","1.94.1+dfsg1-1~exp1","1.94.1+dfsg1-1~exp2","1.94.1+dfsg1-1~exp3","1.95.0+dfsg1-1","1.95.0+dfsg1-2","1.95.0+dfsg1-2~bpo13+1","1.96.0+dfsg1-1~exp1","1.96.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg1-1+deb13u1"}]}],"versions":["1.85.0+dfsg3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.95.0+dfsg1-2"}]}],"versions":["1.85.0+dfsg3-1","1.86.0+dfsg1-1","1.86.0+dfsg1-1~bpo13+1","1.86.0+dfsg1-1~bpo13+2","1.86.0+dfsg1-1~exp1","1.86.0+dfsg1-1~exp2","1.86.0+dfsg1-1~exp2+x32","1.86.0+dfsg1-1~exp3","1.86.0+dfsg1-1~exp4","1.87.0+dfsg1-1","1.87.0+dfsg1-1~bpo13+1","1.87.0+dfsg1-1~bpo13+2","1.87.0+dfsg1-1~exp1","1.88.0+dfsg1-1","1.88.0+dfsg1-1~exp1","1.88.0+dfsg1-2","1.88.0+dfsg1-2~bpo13+1","1.89.0+dfsg1-1","1.89.0+dfsg1-1~bpo13+1","1.89.0+dfsg1-1~bpo13+2","1.89.0+dfsg1-1~exp1","1.90.0+dfsg1-1","1.90.0+dfsg1-1~bpo13+1","1.90.0+dfsg1-1~bpo13+2","1.90.0+dfsg1-1~exp1","1.91.1+dfsg1-1","1.91.1+dfsg1-1~bpo13+1","1.91.1+dfsg1-1~bpo13+2","1.91.1+dfsg1-1~exp1","1.91.1+dfsg1-1~exp2","1.91.1+dfsg1-1~exp3","1.92.0+dfsg1-1","1.92.0+dfsg1-1~exp1","1.92.0+dfsg1-2","1.92.0+dfsg1-2~bpo13+1","1.93.1+dfsg1-1","1.93.1+dfsg1-1~exp1","1.93.1+dfsg1-2","1.93.1+dfsg1-2~bpo13+1","1.94.1+dfsg1-1","1.94.1+dfsg1-1~bpo13+1","1.94.1+dfsg1-1~bpo13+2","1.94.1+dfsg1-1~bpo13+3","1.94.1+dfsg1-1~exp1","1.94.1+dfsg1-1~exp2","1.94.1+dfsg1-1~exp3","1.95.0+dfsg1-1","1.95.0+dfsg1-2~bpo13+1"]},{"source":"osv","ecosystem":"crates.io","package":"cargo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.97.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-1","0.16.0-0ubuntu1~16.04.1","0.18.0-0ubuntu0.16.04.1","0.22.0-0ubuntu0.16.04.1","0.23.0-0ubuntu0.16.04.1","0.25.0-1ubuntu1~16.04.1","0.26.0-0ubuntu2~16.04.1","0.29.0-1ubuntu1~16.04.1","0.31.0-3ubuntu1~16.04.1","0.32.0-1~exp1ubuntu1~16.04.1","0.33.0-1ubuntu1~16.04.1","0.35.0-0ubuntu1~16.04.1","0.36.0-0ubuntu1~16.04.1","0.37.0-3ubuntu1~16.04.1","0.38.0-0ubuntu1~16.04.1","0.40.0-3ubuntu1~16.04.1","0.42.0-0ubuntu1~16.04.1","0.44.1-0ubuntu1~16.04.1","0.47.0-1~exp1ubuntu1~16.04.1","0.47.0-1~exp1ubuntu1~16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-0ubuntu1","0.22.0-0ubuntu1","0.22.0-0ubuntu2","0.23.0-0ubuntu1","0.24.0-1ubuntu1","0.25.0-1ubuntu1","0.26.0-0ubuntu1","0.26.0-0ubuntu2","0.29.0-1ubuntu1~18.04.1","0.31.0-3ubuntu1~18.04.4","0.32.0-1~exp1ubuntu1~18.04.1","0.33.0-1ubuntu1~18.04.1","0.35.0-0ubuntu1~18.04.1","0.36.0-0ubuntu1~18.04.1","0.37.0-3ubuntu1~18.04.1","0.38.0-0ubuntu1~18.04.1","0.40.0-3ubuntu1~18.04.1","0.42.0-0ubuntu1~18.04.1","0.44.1-0ubuntu1~18.04.1","0.47.0-1~exp1ubuntu1~18.04.1","0.52.0-0ubuntu1~18.04.1","0.54.0-0ubuntu1~18.04.1","0.58.0-0ubuntu1~18.04.1","0.60.0ubuntu1-0ubuntu1~18.04.1","0.62.0ubuntu0libgit2-0ubuntu0.18.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+dfsg1-4ubuntu1","1.24.1+dfsg1+llvm-0ubuntu1","1.24.1+dfsg1+llvm-0ubuntu2","1.25.0+dfsg1+llvm-0ubuntu1","1.28.0+dfsg1+llvm-0ubuntu1~18.04.1","1.30.0+dfsg1+llvm-2ubuntu1~18.04.1","1.31.0+dfsg1+llvm-2ubuntu1~18.04.1","1.32.0+dfsg1+llvm-1ubuntu1~18.04.1","1.34.1+dfsg2+llvm-0ubuntu1~18.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~18.04.1","1.36.0+dfsg1+llvm-2ubuntu1~18.04.1","1.37.0+dfsg1+llvm-1ubuntu1~18.04.1","1.39.0+dfsg1+llvm-3ubuntu1~18.04.1","1.41.0+dfsg1+llvm-0ubuntu1~18.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~18.04.1","1.47.0+dfsg1+llvm-1ubuntu1~18.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~18.04.1","1.53.0+dfsg1+llvm-4ubuntu1~18.04.1","1.57.0+dfsg1+llvm-0ubuntu1~18.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~18.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.18.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.0-3ubuntu2","0.38.0-0ubuntu1","0.39.0-0ubuntu1","0.39.0+really0.38.0-0ubuntu1","0.39.0+really0.39.0-0ubuntu1","0.40.0-3ubuntu1","0.40.0-3ubuntu2","0.41.0-0ubuntu1","0.42.0-0ubuntu1","0.44.1-0ubuntu1~20.04.1","0.47.0-1~exp1ubuntu1~20.04.1","0.52.0-0ubuntu1~20.04.1","0.54.0-0ubuntu1~20.04.1","0.58.0-0ubuntu1~20.04.1","0.60.0ubuntu1-0ubuntu1~20.04.1","0.62.0ubuntu0libgit2-0ubuntu0.20.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.20.04","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2","1.53.0+dfsg1+llvm-4ubuntu1~20.04.1","1.57.0+dfsg1+llvm-0ubuntu1~20.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.20.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04","1.66.1+dfsg0ubuntu1~llvm-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04.1","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.20.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04","1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04","1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.0+dfsg1+llvm-1~exp3ubuntu1","1.53.0+dfsg1+llvm-4ubuntu1","1.54.0+dfsg2+llvm-3ubuntu1","1.56.0+dfsg1+llvm-2ubuntu1","1.56.0+dfsg1+llvm-2ubuntu2","1.57.0+dfsg1+llvm-0ubuntu1","1.57.0+dfsg1+llvm-0ubuntu2","1.58.1+dfsg1~ubuntu1-0ubuntu1","1.58.1+dfsg1~ubuntu1-0ubuntu2","1.59.0+dfsg1-1~ubuntu2~22.04.1","1.61.0+dfsg1-1~exp1ubuntu0.22.04.1","1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1","1.66.1+dfsg0ubuntu1-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.2","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.22.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.62","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.62.1+dfsg1-1ubuntu0.22.04.1","1.62.1+dfsg1-1ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04","1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04","1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04","1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.81.0+dfsg0ubuntu0-0ubuntu0.22.04","1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04","1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04~ppa3","1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04","1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.22.03","1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04","1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.22.04.1","1.89.0+dfsg~24.04-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.91.1+dfsg~22.04-0ubuntu0.22.04.2","1.91.1+dfsg~22.04-0ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.52.0-0ubuntu1","0.53.0-0ubuntu2","0.54.0-0ubuntu1","0.54.0-0ubuntu2","0.57.0+ubuntu-0ubuntu1","0.58.0-0ubuntu1","0.60.0ubuntu1-0ubuntu1~22.04.1","0.62.0ubuntu0libgit2-0ubuntu0.22.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.22.04","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.71.1+dfsg0ubuntu2-0ubuntu1","1.73.0+dfsg0ubuntu1-0ubuntu1","1.74.1+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu6","1.75.0+dfsg0ubuntu1-0ubuntu7","1.75.0+dfsg0ubuntu1-0ubuntu7.1","1.75.0+dfsg0ubuntu1-0ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.74.1+dfsg0ubuntu1-0ubuntu2","1.74.1+dfsg0ubuntu1-0ubuntu13","1.74.1+dfsg0ubuntu1-0ubuntu15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.76.0+dfsg0ubuntu1-0ubuntu0.24.04","1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.77.2+dfsg1ubuntu1-0ubuntu0.24.04","1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.78.0+dfsg1ubuntu1-0ubuntu0.24.04","1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.79.0+dfsg1ubuntu1-0ubuntu0.24.04","1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.80.1+dfsg0ubuntu1-0ubuntu0.24.04","1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.81.0+dfsg0ubuntu1-0ubuntu0.24.04","1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.82.0+dfsg0ubuntu0-0ubuntu0.24.04","1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04","1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04","1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04","1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.24.04.1","1.89.0+dfsg~24.04-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.91.1+dfsg~24.04-0ubuntu0.24.04.1","1.91.1+dfsg~24.04-0ubuntu0.24.04.2","1.91.1+dfsg~24.04-0ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85.1+dfsg0ubuntu1-0ubuntu1","1.85.1+dfsg0ubuntu2-0ubuntu1","1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.88","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.88.0+dfsg0ubuntu1-0ubuntu1","1.88.0+dfsg0ubuntu1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.91.1+dfsg-0ubuntu3~25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.91.1+dfsg-0ubuntu1","1.91.1+dfsg-0ubuntu2","1.91.1+dfsg-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rustc-1.92","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.92.0+dfsg-0ubuntu1","1.92.0+dfsg-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rustc-1.93","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.93.1+dfsg-0ubuntu4","1.93.1+dfsg-0ubuntu5","1.93.1+dfsg-0ubuntu6"]}],"products":[{"vendor":"rust","product":"cargo"},{"vendor":"rust-lang","product":"cargo"}],"references":[{"url":"https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s","tags":["vendor-advisory","mailing-list","Mailing List","Third Party Advisory","web","report"]},{"url":"https://blog.rust-lang.org/2026/05/25/cve-2026-5222/","tags":["vendor-advisory","Vendor Advisory","report"]},{"url":"https://github.com/rust-lang/cargo/pull/17031","tags":["patch","Issue Tracking","Patch","web","report"]},{"url":"https://github.com/rust-lang/cargo/security/advisories/GHSA-p688-r7jv-fm6f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5222","tags":["web","advisory"]},{"url":"https://blog.rust-lang.org/2026/05/25/cve-2026-5222","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p688-r7jv-fm6f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-5222","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-5222","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5222","tags":["advisory"]},{"url":"https://github.com/rust-lang/cargo","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-5222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5222","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-5222","title":"Cargo can be coerced to share credentials between registries","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T08:54:56.348Z","modified":"2026-05-26T14:43:10.019Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-31654","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T08:54:56Z","modified":"2026-05-26T14:43:10Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:21:06.903439Z"}],"ghsa":[{"id":"GHSA-p688-r7jv-fm6f","title":"Cargo can be coerced to share credentials between registries","description":"The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the [sparse index protocol][1]. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\n\nThis vulnerability is tracked as CVE-2026-5222. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.\n\n## Overview\n\nOriginally Cargo only supported storing a registry's index within git repositories. Most git hosting solutions allow accessing a git repository with or without the `.git` suffix, so Cargo mirrored this behavior when normalizing registry URLs. This allowed credentials for `https://example.com/index` to be used for `https://example.com/index.git`.\n\nThis normalization was unintentionally applied to the new sparse indexes too. Sparse indexes can be hosted on any HTTPS server, which treat URLs ending with `.git` as different URLs than those without the suffix.\n\nIf the following conditions apply:\n\n* `https://example.com/index` is a sparse index.\n* `https://example.com/index` allows crates to depend on crates from any other registry.\n* The attacker is able to publish crates on `https://example.com/index`.\n* The attacker is able to upload arbitrary files to `https://example.com/index.git`.\n\n...the attacker could configure `https://example.com/index.git` to be a Cargo sparse registry requiring authentication for downloads, and with a download URL pointing to a server recording any credentials set to it.\n\nWhen the attacker then publishes a crate `foo` to `https://example.com/index` depending on a crate `bar` from `https://example.com/index.git`, and tricks the victim into downloading `foo`,  Cargo will think the two registries share the same credential and send the victim's Cargo token to the malicious registry.\n\n## Mitigations\n\nRust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.\n\n## Affected versions\n\nAll versions of Cargo shipped between Rust 1.68 (the stabilization of sparse registries) and 1.96 are affected.\n\n## Acknowledgements\n\nCargo would like to thank Christos Papakonstantinou for reporting this issue according to the [Rust security policy][2].\n\nCargo also wants to thank the members of the Rust project who helped address the vulnerability: Arlo Siemens for developing the fix; Weihang Lo, Eric Huss and Emily Albini for reviewing the fix; Emily Albini for writing this advisory; Emily Albini, Josh Stone and Manish Goregaokar for coordinating the disclosure.\n\n[1]: https://doc.rust-lang.org/cargo/reference/registries.html#registry-protocols\n[2]: https://rust-lang.org/policies/security","status":"published","published":"2026-06-26T21:47:54Z","modified":"2026-06-26T21:47:56Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:40:34.713036Z"}],"nvd":[{"id":"CVE-2026-5222","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:15.273Z","modified":"2026-07-23T17:10:00.123Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"ALPINE-CVE-2026-5222","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:15.273Z","modified":"2026-11-03T06:33:03.37742109Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-5222","status":"published","published":"2026-05-28T06:11:42.104051Z","modified":"2026-07-22T07:15:05.482410833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"DEBIAN-CVE-2026-5222","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:15.273Z","modified":"2026-10-01T03:03:26.064053388Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"GHSA-p688-r7jv-fm6f","title":"Cargo can be coerced to share credentials between registries","description":"The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the [sparse index protocol][1]. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\n\nThis vulnerability is tracked as CVE-2026-5222. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.\n\n## Overview\n\nOriginally Cargo only supported storing a registry's index within git repositories. Most git hosting solutions allow accessing a git repository with or without the `.git` suffix, so Cargo mirrored this behavior when normalizing registry URLs. This allowed credentials for `https://example.com/index` to be used for `https://example.com/index.git`.\n\nThis normalization was unintentionally applied to the new sparse indexes too. Sparse indexes can be hosted on any HTTPS server, which treat URLs ending with `.git` as different URLs than those without the suffix.\n\nIf the following conditions apply:\n\n* `https://example.com/index` is a sparse index.\n* `https://example.com/index` allows crates to depend on crates from any other registry.\n* The attacker is able to publish crates on `https://example.com/index`.\n* The attacker is able to upload arbitrary files to `https://example.com/index.git`.\n\n...the attacker could configure `https://example.com/index.git` to be a Cargo sparse registry requiring authentication for downloads, and with a download URL pointing to a server recording any credentials set to it.\n\nWhen the attacker then publishes a crate `foo` to `https://example.com/index` depending on a crate `bar` from `https://example.com/index.git`, and tricks the victim into downloading `foo`,  Cargo will think the two registries share the same credential and send the victim's Cargo token to the malicious registry.\n\n## Mitigations\n\nRust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.\n\n## Affected versions\n\nAll versions of Cargo shipped between Rust 1.68 (the stabilization of sparse registries) and 1.96 are affected.\n\n## Acknowledgements\n\nCargo would like to thank Christos Papakonstantinou for reporting this issue according to the [Rust security policy][2].\n\nCargo also wants to thank the members of the Rust project who helped address the vulnerability: Arlo Siemens for developing the fix; Weihang Lo, Eric Huss and Emily Albini for reviewing the fix; Emily Albini for writing this advisory; Emily Albini, Josh Stone and Manish Goregaokar for coordinating the disclosure.\n\n[1]: https://doc.rust-lang.org/cargo/reference/registries.html#registry-protocols\n[2]: https://rust-lang.org/policies/security","status":"published","published":"2026-06-26T21:47:54Z","modified":"2026-06-26T22:11:30.823511Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2026-5222","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:00Z","modified":"2026-06-03T07:15:35.302373457Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-88275","title":"CVE-2026-5222 affecting package rust for versions less than 1.75.0-30","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:15Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"AZL-88281","title":"CVE-2026-5222 affecting package rust for versions less than 1.90.0-9","description":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.","status":"published","published":"2026-05-25T10:16:15Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"}]}}