CVE-2026-5222: Cargo Information Disclosure Vulnerability

CVE-2026-5222 Overview

Cargo, the Rust package manager, incorrectly normalized URLs for third-party registries using the sparse index protocol. The flaw affects Cargo versions 1.68 through 1.96. When a hosting provider permits multiple registries under arbitrary names within the same domain, an attacker who can publish crates to one registry can capture credentials submitted by other users of the same registry.

The issue is tracked as CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions. The Rust Security Response Working Group rates the severity as low because the exploitation conditions are narrow.

Critical Impact
An attacker publishing crates on a multi-tenant sparse-index registry can harvest authentication tokens belonging to other users of the same registry.

Affected Products

Cargo 1.68 through 1.96
Rust toolchains shipping the affected Cargo versions
Third-party registries using the sparse index protocol on shared domains

Discovery Timeline

2026-05-25 - CVE CVE-2026-5222 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-5222

Vulnerability Analysis

Cargo communicates with sparse-index registries over HTTPS to retrieve crate metadata and authenticate publishing operations. Cargo associates credentials with a registry URL stored in the user's configuration. The vulnerable code paths fail to canonicalize that URL before deciding which credentials to attach to outgoing requests.

Because the URL is not normalized, two textually different URLs that resolve to the same logical registry, or that share a domain with a malicious registry, can be treated inconsistently. Cargo may attach the credentials intended for one registry when contacting another endpoint controlled by a different tenant on the same host.

The attacker must control a registry hosted under the same domain as the victim registry. This typically requires a hosting provider that allows multiple sparse-index registries to coexist under arbitrary path or subpath names within one domain. The fix lands in cargo pull request #17031.

Root Cause

The root cause is improper URL normalization before credential lookup. Cargo's sparse-index client used non-canonical URL strings to identify a registry. As a result, authorization decisions about which token to send were based on a non-canonical representation, matching [CWE-647].

Attack Vector

The attack proceeds over the network and requires the attacker to publish crates to the shared registry. A victim must perform a Cargo operation against the manipulated registry name. Cargo then sends the victim's authentication token to a registry path the attacker can read. See the Rust Blog advisory for CVE-2026-5222 for the full technical write-up.

Detection Methods for CVE-2026-5222

Indicators of Compromise

Outbound HTTPS requests from cargo processes to unexpected paths on a shared registry domain.
Authorization headers sent to sparse-index endpoints that do not match the user's configured registry path.
New or unfamiliar entries under [registries] in ~/.cargo/config.toml referencing the same host as a trusted registry.

Detection Strategies

Inventory installed Rust toolchains and flag any Cargo version between 1.68 and 1.96 inclusive.
Audit registry hosting platforms used by developers to confirm whether multiple tenants share a single domain.
Review registry server logs for requests that include credentials but target a different tenant's index path.

Monitoring Recommendations

Forward developer endpoint telemetry and registry access logs into a central data lake for correlation.
Alert on Cargo network connections that contact host paths outside an approved registry allowlist.
Rotate registry tokens periodically and monitor for token use from unexpected source IP addresses.

How to Mitigate CVE-2026-5222

Immediate Actions Required

Upgrade Cargo and the Rust toolchain to a release that contains the fix from pull request #17031.
Rotate any registry authentication tokens used with Cargo versions 1.68 through 1.96 against multi-tenant sparse-index registries.
Verify the index URL of each entry under [registries] in ~/.cargo/config.toml and remove unused registries.

Patch Information

The Rust project published the fix and advisory on 2026-05-25. Review the RustLang Security Announcement and apply the updated Cargo release through rustup update stable. The code change is described in the Rust Blog advisory.

Workarounds

Avoid hosting multiple third-party registries under arbitrary names within a single shared domain.
Host each private sparse-index registry on its own dedicated domain or subdomain to isolate credentials.
Restrict publish permissions on shared registries until all clients are upgraded.

bash

# Configuration example
rustup update stable
cargo --version    # confirm a fixed Cargo release
cargo logout --registry my-registry
cargo login --registry my-registry