CVE-2026-82247: gitoxide gix-url Auth Bypass Vulnerability

CVE-2026-82247 Overview

CVE-2026-82247 is a credential exposure vulnerability in gitoxide's gix-url crate. The hand-rolled URL parser does not treat ? or # as terminators of the authority component, deviating from RFC 3986. This parsing flaw causes gix-transport's HTTP redirect identity guard (can_reuse_identity) to compare the wrong host and fail open. An attacker who controls a redirect response can craft a Location header that tricks gitoxide into sending HTTP Basic Authorization credentials to an unintended host. The gix-url crate is affected in versions <= 0.32.0 (fixed in 0.37.1), and gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Critical Impact
An attacker-controlled HTTP redirect can exfiltrate a caller's HTTP Basic credentials by exploiting inconsistent authority parsing between gitoxide and RFC 3986.

Affected Products

gitoxide gix-url crate versions <= 0.32.0 (fixed in 0.37.1)
gitoxide gix-transport crate versions <= 0.49.0 (fixed in 0.58.1)
Rust applications and tooling built on the gitoxide Git implementation

Discovery Timeline

2026-08-28 - CVE-2026-82247 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82247

Vulnerability Analysis

The vulnerability sits at the intersection of two components. The gix-url crate parses Git remote URLs with a custom parser rather than a strict RFC 3986 implementation. That parser fails to recognize ? and # as delimiters that terminate the authority (host) component. As a result, a URL such as https://attacker.example?@victim.example/repo is interpreted with an authority string that extends beyond what standards-compliant parsers consider the host.

Downstream, gix-transport performs HTTP redirect handling. When following a Location header, it calls can_reuse_identity to decide whether stored HTTP Basic credentials should be sent to the redirect target. Because that check relies on gix-url's incorrect authority extraction, the guard compares a misidentified host and returns true when it should return false. The credential check fails open, and the Authorization header is forwarded to the attacker-controlled origin. This weakness is classified as CWE-522: Insufficiently Protected Credentials.

Root Cause

The root cause is non-conformant URL parsing in gix-url. RFC 3986 defines the authority component as terminated by /, ?, #, or end-of-string. The hand-rolled parser only honors a subset of those delimiters, allowing an attacker-supplied query-delimited payload to smuggle the original host into what looks like userinfo. The identity guard trusts the parser's host output without cross-validating it against a standards-compliant representation.

Attack Vector

Exploitation requires an attacker to control an HTTP response returned to a gitoxide-based client, typically by operating or compromising a server the client contacts, or by intercepting cleartext HTTP. The attacker returns an HTTP redirect with a Location header of the form https://attacker-host?@original-host/path. When gitoxide follows the redirect, its identity guard misidentifies the destination host as original-host and reuses the stored HTTP Basic credentials. The client then transmits the Authorization header to attacker-host, disclosing the base64-encoded username and password. No user interaction or authentication is required by the attacker to receive the leaked credentials.

A sanitized example is not published in the referenced advisories. See the GitHub Security Advisory GHSA-jrcm-326h-gpp8 and the VulnCheck Advisory on Gitoxide Credential Leak for further technical detail.

Detection Methods for CVE-2026-82247

Indicators of Compromise

Outbound HTTPS requests from developer workstations or CI runners to unexpected hosts carrying an Authorization: Basic header shortly after a Git fetch, clone, or push.
HTTP 302/307 redirect responses containing Location headers with ?@ or #@ sequences between the scheme and the original host.
Git operations initiated by tools linking gix-url<= 0.32.0 or gix-transport<= 0.49.0.

Detection Strategies

Inspect egress proxy logs for Location header values that contain ? or # before the @ character in the URL authority.
Correlate Git client version metadata in CI pipelines with the vulnerable gitoxide crate versions to identify at-risk build agents.
Compare the parsed host of any redirect target against an RFC 3986-conformant parser and alert on divergence.

Monitoring Recommendations

Enable full TLS inspection on developer and CI egress paths so redirect chains involving Git remotes can be evaluated.
Alert on repeated HTTP Basic authentication attempts to unrecognized hosts from build infrastructure.
Track Software Bill of Materials (SBOM) data for Rust dependencies and flag builds pinning vulnerable gix-url or gix-transport versions.

How to Mitigate CVE-2026-82247

Immediate Actions Required

Upgrade gix-url to 0.37.1 or later and gix-transport to 0.58.1 or later in all Rust projects and downstream tooling.
Rotate any HTTP Basic credentials, Personal Access Tokens, or passwords used with vulnerable gitoxide clients against remotes that could have been redirected.
Audit CI/CD systems, package registries, and developer machines for gitoxide-based tooling and enforce a minimum safe version.

Patch Information

Maintainers fixed the parsing defect in gix-url0.37.1 and the transport-layer identity check in gix-transport0.58.1. Consumers must update both crates, as applications may depend on gix-transport transitively. Refer to the GitHub Security Advisory GHSA-jrcm-326h-gpp8 for the authoritative fix commits and version guidance.

Workarounds

Disable HTTP redirect following in gitoxide-based clients where the option is exposed, until the crates can be upgraded.
Prefer SSH remotes or short-lived token authentication over long-lived HTTP Basic credentials.
Restrict outbound HTTPS from build agents to a curated allow-list of Git hosting domains to limit exfiltration paths.

bash

# Update vulnerable crates in a Cargo project
cargo update -p gix-url --precise 0.37.1
cargo update -p gix-transport --precise 0.58.1
cargo tree -i gix-url
cargo tree -i gix-transport