CVE-2026-82255: gitoxide HTTP Credential Leak Vulnerability

CVE-2026-82255 Overview

CVE-2026-82255 is a credential leak vulnerability in gitoxide, a pure-Rust implementation of Git. Versions from 0.25.4 onward ship a curl-based HTTP transport backend that forwards authentication credentials to attacker-controlled servers following HTTP redirects. The credential validation logic inspects the original request URL rather than the effective URL after redirection. Attackers can exploit this by hosting a repository that redirects across domains or downgrades HTTPS to HTTP, capturing Git authentication tokens in the process. The flaw is tracked as an insufficiently protected credentials issue [CWE-522].

Critical Impact
Authentication tokens transmitted to gitoxide clients can be exfiltrated to attacker-controlled hosts through crafted HTTP redirects, enabling repository takeover and downstream supply chain compromise.

Affected Products

gitoxide versions from 0.25.4 onward
The curl-based HTTP transport backend within gitoxide
Downstream tooling and Rust projects depending on vulnerable gitoxide crates for Git operations

Discovery Timeline

2026-08-28 - CVE-2026-82255 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82255

Vulnerability Analysis

The defect lives in the curl-based HTTP transport used by gitoxide when communicating with remote Git servers over HTTP or HTTPS. Git clients typically attach credentials such as personal access tokens or basic authentication headers to requests directed at a specific origin. Safe implementations verify the effective destination of each request before releasing credentials, especially when the server responds with a redirect.

gitoxide instead validates the original request URL. When the remote server issues an HTTP 3xx redirect, curl follows the redirect and reuses the credentials associated with the initial request. Because the effective URL is never re-evaluated against the credential scope, the tokens accompany the follow-up request to any host the attacker chooses. This behavior corresponds to insufficiently protected credentials [CWE-522].

Root Cause

The root cause is a mismatch between the URL used for credential-scope validation and the URL actually contacted by the HTTP client. The gitoxide transport passes credentials into curl and delegates redirect handling without instructing curl to strip authentication material on cross-origin redirects. Because the check runs once against the pre-redirect URL, subsequent hops inherit the credentials without further verification.

Attack Vector

An attacker hosts a Git repository or intercepts an existing one to return a redirect toward a controlled endpoint. When a gitoxide-based client clones, fetches, or pushes to the original URL, the transport follows the redirect and forwards the Authorization header to the attacker. Two exploitation shapes are documented in the advisory: cross-domain redirects that move the request to a foreign host, and protocol downgrades that redirect an HTTPS request to plaintext HTTP. User interaction is required, since a developer or automated pipeline must initiate the Git operation against the malicious URL.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-9857-6mw7-fq2m and the VulnCheck advisory. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2026-82255

Indicators of Compromise

Outbound HTTPS or HTTP requests from developer workstations or CI runners to unexpected hosts immediately following a Git clone, fetch, or push operation.
HTTP 3xx responses from Git remotes that redirect to a different registrable domain or downgrade the scheme from https:// to http://.
Authentication failures on legitimate Git hosts followed by successful authentication events from unfamiliar IP addresses using the same account or token.

Detection Strategies

Inventory Rust projects and dependency manifests for the gitoxide crate and related sub-crates at version 0.25.4 or newer.
Inspect proxy and egress logs for Git user-agent traffic that traverses a cross-domain redirect chain.
Alert on personal access tokens or deploy keys used from source addresses outside the expected build infrastructure ranges.

Monitoring Recommendations

Enable audit logging on source code management platforms and correlate token usage against the source IP and user-agent of each request.
Instrument CI/CD systems to capture the effective URL of Git operations and flag mismatches with the configured remote.
Rotate and short-scope Git credentials so that any leakage window is bounded by an aggressive expiration policy.

How to Mitigate CVE-2026-82255

Immediate Actions Required

Upgrade gitoxide to the patched release referenced in the GHSA-9857-6mw7-fq2m advisory and rebuild all dependent binaries.
Rotate any Git personal access tokens, deploy keys, or basic-auth credentials that may have been used with a vulnerable gitoxide client against untrusted remotes.
Restrict outbound network access from build agents so Git traffic can only reach approved source code management hosts.

Patch Information

The gitoxide maintainers have published a fix in the GitHub Security Advisory GHSA-9857-6mw7-fq2m. The patched code re-validates the effective URL after each redirect and suppresses credential forwarding when the destination falls outside the original credential scope. Consult the advisory for the specific fixed crate versions and update all transitive dependencies accordingly.

Workarounds

Disable HTTP redirect following in the curl-based transport by configuring the underlying HTTP client to reject 3xx responses on authenticated requests.
Prefer SSH-based Git remotes over HTTP or HTTPS remotes for workflows that rely on long-lived credentials.
Use short-lived, narrowly scoped tokens issued through a credential helper so that any leaked material expires before it can be reused.

bash

# Example: pin gitoxide to a patched release in Cargo.toml
# Replace <patched_version> with the fixed release listed in GHSA-9857-6mw7-fq2m
[dependencies]
gitoxide = "=<patched_version>"