Credential Disclosure Vulnerability in libgit2 by GitHub
CVE-2026-53586
6.5MEDIUM
What is CVE-2026-53586?
The libgit2 library allows developers to integrate Git functionality into applications. In versions prior to 1.8.6 and 1.9.5, a vulnerability exists in the HTTP transport handling, where redirecting hosts can lead to unauthorized disclosure of sensitive credentials such as HTTP Basic passwords or personal access tokens. This occurs due to the method of passing URLs during credential callbacks, which can expose user credentials to potentially malicious redirect targets. Users are advised to update to the latest versions to mitigate this risk.
Affected Version(s)
libgit2 < 1.8.6 < 1.8.6
libgit2 >= 1.9.0, < 1.9.5 < 1.9.0, 1.9.5