CVE-2026-84149: ERP System Information Disclosure Flaw

CVE-2026-84149 Overview

CVE-2026-84149 is an information disclosure vulnerability in an ERP system caused by a publicly accessible .git directory. An unauthenticated remote attacker can access the exposed directory over the network and retrieve repository metadata and associated files. The retrieved data enables reconstruction of the application's source code, exposing business logic, credentials, and internal implementation details. The weakness is categorized under CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere. CERT-In tracks this issue in advisory CIVN-2026-0430.

Critical Impact
Unauthenticated remote attackers can reconstruct application source code, harvest hardcoded credentials, and identify secondary vulnerabilities for follow-on exploitation.

Affected Products

ERP system referenced in CERT-In advisory CIVN-2026-0430
Specific vendor and product identifiers are not published in the NVD record
Any deployment serving the .git directory over HTTP or HTTPS

Discovery Timeline

2026-09-01 - CVE-2026-84149 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84149

Vulnerability Analysis

The vulnerability stems from the ERP web server exposing the .git directory within the web root. Git stores a complete snapshot of the repository inside this directory, including object files, references, configuration, and commit history. When the web server serves this path without access controls, remote clients can enumerate its contents and download the underlying objects.

Attackers use the retrieved objects to reconstruct the full source tree. Reconstructed code frequently reveals API endpoints, database connection strings, cryptographic keys, and authentication logic. The disclosure converts a black-box target into a white-box target and reduces the cost of discovering additional vulnerabilities in the ERP application.

Root Cause

The root cause is a deployment misconfiguration. Developers deployed the application without removing the version-control directory and without configuring the web server to deny access to dotfile paths. The condition maps to CWE-527, which covers exposure of source control artifacts to unauthorized parties.

Attack Vector

The attack requires no authentication and no user interaction. An attacker issues HTTP requests to paths such as /.git/HEAD, /.git/config, and /.git/objects/. If the server returns valid Git metadata, the attacker uses common tooling to walk object references and reassemble the repository. See the CERT-In advisory CIVN-2026-0430 for the vendor-referenced technical description.

Detection Methods for CVE-2026-84149

Indicators of Compromise

Web server access logs containing sequential requests to /.git/HEAD, /.git/config, /.git/index, and /.git/refs/heads/*
Bulk GET requests to /.git/objects/ subpaths from a single client within a short time window
User-Agent strings associated with dumper tools such as git-dumper, GitTools, or generic scraping libraries
Outbound archival transfers of Git objects to attacker-controlled infrastructure

Detection Strategies

Scan external attack surface for HTTP 200 responses on /.git/HEAD and /.git/config paths
Alert on repeated requests to dotfile paths on production hosts
Correlate reconnaissance activity with subsequent authenticated attacks against the same application

Monitoring Recommendations

Ingest web server and WAF logs into a centralized analytics platform for pattern analysis
Baseline normal request patterns to the ERP host and flag deviations targeting version-control paths
Monitor DNS and outbound traffic from ERP servers to detect data exfiltration attempts following disclosure

How to Mitigate CVE-2026-84149

Immediate Actions Required

Remove the .git directory from all production web roots and deployment artifacts
Configure the web server to return HTTP 403 or 404 for requests targeting dotfile paths
Rotate every credential, API key, and secret that may have been committed to the repository history
Review web server access logs for prior enumeration of .git paths and treat any successful retrieval as a confirmed disclosure

Patch Information

The NVD record for CVE-2026-84149 does not list a vendor patch identifier. Refer to CERT-In advisory CIVN-2026-0430 for vendor guidance. Remediation is primarily a deployment and configuration change rather than a code patch.

Workarounds

Adopt build pipelines that export only production artifacts and exclude .git and other version-control metadata
Deploy a Web Application Firewall rule blocking requests matching the pattern ^/\.git(/|$)
Enforce automated pre-deployment scans that fail builds when version-control directories exist in the release package
Restrict web server directory listing and deny access to hidden files by default

bash

# Nginx configuration example to deny access to .git paths
location ~ /\.git {
    deny all;
    access_log off;
    log_not_found off;
    return 404;
}

# Apache equivalent (.htaccess or vhost)
# RedirectMatch 404 /\.git