CVE-2026-62960: Git for Windows Information Disclosure Flaw

CVE-2026-62960 Overview

CVE-2026-62960 is an information disclosure vulnerability in Git for Windows affecting versions prior to 2.55.0.windows.4. A malicious remote Git server can advertise a bundle URI that Git for Windows interprets as a local filesystem or UNC path. When a client clones or fetches with transfer.bundleuri=true, Windows initiates an outbound SMB connection to the attacker-controlled share. This connection can leak NTLM authentication material to a host chosen by the attacker. The flaw is classified as information exposure [CWE-200] and requires user interaction to trigger the clone or fetch operation.

Critical Impact
Attackers who control a Git server can coerce Windows clients into SMB authentication requests, exposing NTLM hashes suitable for offline cracking or relay attacks.

Affected Products

Git for Windows versions prior to 2.55.0.windows.4
Windows clients performing git clone or git fetch with transfer.bundleuri=true
Environments using Git protocol version 2 against untrusted remotes

Discovery Timeline

2026-08-21 - CVE-2026-62960 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62960

Vulnerability Analysis

The vulnerability resides in the bundle URI handling logic within bundle-uri.c. When transfer.bundleuri=true is set, Git honors bundle URIs advertised by the remote server during protocol version 2 negotiation. The advertised URI flows through transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() without protocol restrictions. Any value that is not an HTTP or HTTPS URL is treated as a local filesystem path. A file:// prefix is stripped, and bare UNC paths such as \\attacker.example.com\share\bundle are passed directly to the Windows file APIs. Windows resolves the UNC path over SMB and automatically authenticates using the current user context, transmitting NTLM challenge-response material to the attacker-controlled host.

Root Cause

The root cause is missing protocol validation on advertised bundle URIs. The client code accepted any scheme, including non-network schemes, and did not enforce protocol.*.allow policies against advertised URIs. This allowed a remote server to influence local filesystem or SMB operations on the client.

Attack Vector

An attacker hosts or compromises a Git server and configures it to advertise a bundle URI pointing to an attacker-controlled SMB share. A victim clones or fetches from that server with transfer.bundleuri enabled. Git for Windows resolves the UNC path, and Windows performs implicit NTLM authentication against the remote SMB endpoint. The attacker captures the NTLMv2 response for offline cracking or SMB relay.

 #include "remote.h"
 #include "trace2.h"
 #include "odb.h"
+#include "transport.h"
+#include "url.h"
 
 static struct {
 	enum bundle_list_heuristic heuristic;

Source: GitHub Commit a935247. The patch adds transport and URL header dependencies to enforce protocol allowlists on advertised bundle URIs.

Detection Methods for CVE-2026-62960

Indicators of Compromise

Outbound SMB (TCP 445) connections from developer workstations to unexpected external hosts immediately following git clone or git fetch operations.
Git process (git.exe, git-remote-https.exe) initiating file access to UNC paths not associated with internal file servers.
Presence of transfer.bundleuri=true in system, global, or repository-scoped Git configuration files.

Detection Strategies

Correlate Git client execution telemetry with subsequent SMB session establishment to non-corporate destinations.
Inspect Git configuration across managed endpoints for the transfer.bundleURI setting and flag any repository advertising non-HTTP(S) bundle.payload.uri values.
Alert on NTLM authentication attempts leaving the network perimeter destined for arbitrary external IPs.

Monitoring Recommendations

Log Windows Security Event ID 4648 (explicit credential use) and SMB client events referencing external UNC paths.
Monitor EDR process trees where git.exe is the parent of file operations targeting \\?\UNC\ or \\<host>\ paths.
Track Git version inventory to identify hosts still running Git for Windows below 2.55.0.windows.4.

How to Mitigate CVE-2026-62960

Immediate Actions Required

Upgrade all Git for Windows installations to version 2.55.0.windows.4 or later.
Audit and disable transfer.bundleuri in global and system Git configuration until upgrades are complete.
Block outbound SMB (TCP 445 and 139) at the network perimeter to prevent NTLM material from leaving the network.

Patch Information

The fix is available in Git for Windows release v2.55.0.windows.4. The patch, documented in GitHub Security Advisory GHSA-xrpg-8j9v-v282, enforces protocol.*.allow checks on advertised bundle URIs. Non-HTTP(S) schemes, including bare UNC paths and file:// URIs, are rejected by default.

Workarounds

Set git config --global transfer.bundleURI false on all Windows endpoints as an interim control.
Use git config --global protocol.file.allow never to reject file-scheme URIs across Git operations.
Restrict outbound SMB with Windows Defender Firewall or group policy to permit connections only to trusted internal file server ranges.

bash

# Configuration example
git config --global transfer.bundleURI false
git config --global protocol.file.allow never
git config --global protocol.allow user