CVE-2026-59247: Gleam Auth Bypass Vulnerability

CVE-2026-59247 Overview

CVE-2026-59247 is an insufficient verification of data authenticity vulnerability [CWE-345] in the Gleam programming language toolchain. During dependency resolution, Gleam fetches signed package metadata from the Hex repository but then overwrites the verified outer_checksum and dependency requirements with values retrieved from an unsigned Hex API endpoint. An adversary in the middle who can intercept TLS with a trusted certificate can substitute forged package archives that pass checksum validation. The flaw affects Gleam versions from 0.18.0 up to (but not including) 1.18.0. Only projects that resolve or update Hex dependencies are exposed; builds reusing an unchanged manifest.toml continue to verify tarballs against pinned, known-good checksums.

Critical Impact
An attacker positioned to inspect TLS traffic can substitute forged Hex package contents during dependency resolution, resulting in loss of integrity of downloaded dependencies and potential supply chain compromise of Gleam builds.

Affected Products

Gleam CLI versions 0.18.0 through versions prior to 1.18.0
gleam_cli::dependencies::lookup_package function
gleam_core::hex::get_package_release function

Discovery Timeline

2026-07-29 - CVE-2026-59247 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-59247

Vulnerability Analysis

The vulnerability lies in how Gleam handles two separate data sources during Hex dependency resolution. Gleam first fetches package metadata from the signature-verified Hex repository, which contains the authoritative dependency requirements and SHA-256 outer_checksum for each release. This metadata is protected by the Hex repository signing key.

After version resolution, gleam_cli::dependencies::lookup_package issues a second request through gleam_core::hex::get_package_release to the unsigned Hex API. The response from this API, which is not covered by the Hex signing key, provides the outer_checksum and dependency names that Gleam records into manifest.toml. Verified metadata is effectively discarded in favor of unverified API data.

Because the checksum written to manifest.toml originates from an unauthenticated source, an attacker who forges both the API response and the corresponding tarball can produce a matching forged checksum. Gleam then verifies the forged tarball against the attacker-controlled checksum, accepts it, and extracts it as a dependency source.

Root Cause

The root cause is trust misplacement between two data channels. Signature verification is performed on the repository metadata, but the values persisted to manifest.toml are taken from the unsigned Hex API response, breaking the chain of trust established by the repository signing key.

Attack Vector

Exploitation requires an adversary in the middle capable of intercepting TLS with a certificate trusted by the Gleam process. This includes TLS-inspecting proxies that install a CA into the operating system trust store or a CA added via GLEAM_CACERTS_PATH. The attacker must modify both the API release response and the corresponding repository tarball, then supply a forged archive whose checksum matches the injected value.

rust

         .collect()
 }
 
-/// Determine the information to add to the manifest for a specific package
-async fn lookup_package(
-    name: String,
-    version: Version,
+/// The parts of a resolved Hex package taken from the verified registry
+/// metadata.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct VerifiedRelease {
+    outer_checksum: Vec<u8>,
+    requirements: Vec<EcoString>,
+}
+
+/// Collect the signed release details for each resolved Hex package. The
+/// verified `hexpm::Package` was fetched and its signature checked during
+/// resolution. Local and git packages are provided directly and carry no Hex
+/// metadata, so they are skipped.
+fn verified_releases(
+    package_fetcher: &impl dependency::PackageFetcher,
+    resolved: &dependency::PackageVersions,
     provided: &HashMap<EcoString, ProvidedPackage>,
-    credentials: Option<&hexpm::Credentials>,
-) -> Result<ManifestPackage> {
-    match provided.get(name.as_str()) {
-        Some(provided_package) => Ok(provided_package.to_manifest_package(name.as_str())),
-        None => {
-            let config = hexpm::Config::new();
-            let release =

Source: GitHub Commit c9c0d48. The patch introduces a VerifiedRelease struct and a verified_releases function that persist the outer_checksum and requirements sourced from the signature-verified hexpm::Package metadata rather than from the unsigned API response.

Detection Methods for CVE-2026-59247

Indicators of Compromise

Presence of custom root CAs in the operating system trust store or referenced via the GLEAM_CACERTS_PATH environment variable on developer or CI systems.
Unexpected changes to outer_checksum values in manifest.toml for previously pinned Hex dependencies.
TLS-inspecting proxies or corporate middleboxes sitting between Gleam clients and hex.pm.

Detection Strategies

Compare outer_checksum values in committed manifest.toml files against checksums published by the signed Hex repository metadata for each release.
Audit Gleam CLI versions across build agents and developer workstations; flag any version between 0.18.0 and 1.18.0.
Monitor network egress from build systems for TLS interception patterns, including unexpected certificate issuers on connections to hex.pm.

Monitoring Recommendations

Log and review changes to GLEAM_CACERTS_PATH and to the system trust store on CI runners and developer endpoints.
Track dependency resolution events by watching manifest.toml diffs during pull requests and rejecting checksum changes without an approved version bump.
Alert on Gleam builds that regenerate manifest.toml outside of controlled dependency-update workflows.

How to Mitigate CVE-2026-59247

Immediate Actions Required

Upgrade Gleam to version 1.18.0 or later on all developer workstations and build agents.
Audit existing manifest.toml files by re-resolving dependencies with the patched Gleam version and comparing checksums.
Remove unnecessary custom root CAs from operating system trust stores on systems that build Gleam projects.

Patch Information

The fix is delivered in Gleam 1.18.0 via commit c9c0d48c123c8abae6db8dd61b25ccb427ed3d35. The patch replaces lookup_package with lookup_hex_package and introduces verified_releases, ensuring the outer_checksum and dependency requirements written to manifest.toml come from the signature-verified hexpm::Package metadata. See the GitHub Security Advisory GHSA-4vvc-458m-r82g and the CNA advisory for full details.

Workarounds

Avoid resolving or updating Hex dependencies on systems that have TLS-inspecting proxies in the network path to hex.pm.
Reuse a known-good, committed manifest.toml for builds; unchanged manifests continue to verify tarballs against their pinned checksums.
Do not set GLEAM_CACERTS_PATH to point at CA bundles that include TLS-inspection CAs, and restrict which processes can modify the OS trust store.

bash

# Upgrade Gleam to a patched release
gleam --version
# If below 1.18.0, upgrade via your platform package manager, e.g.:
brew upgrade gleam
# or download the 1.18.0+ release from https://github.com/gleam-lang/gleam/releases

# Re-resolve dependencies with the patched compiler and review the diff
rm manifest.toml
gleam deps download
git diff manifest.toml