CVE-2026-82247

CVE-2026-82247 is a credential-exposure flaw (CWE-522, Insufficiently Protected Credentials) in the gix-url URL parser used by gitoxide, a Rust-language Git implementation: a crafted URL involving the '?' and '@' characters causes the parser to misread the URL's authority, so gix-transport sends the caller's HTTP Basic Authorization credentials to a host other than the one they belong to. It is triggered whenever an application using an affected gix-transport (versions <= 0.49.0) processes such an attacker-influenced HTTP(S) URL while carrying Basic-auth credentials. An attacker who controls the URL (for example, any scenario where the remote/repository URL is user-supplied or otherwise not fully trusted) can capture the victim's Basic-auth username and password or token and replay them against the legitimate host, gaining access to the associated account or repositories. Affected are Rust applications, tools and CI pipelines built on gitoxide's gix/gix-transport crates that fetch over HTTP(S) using Basic authentication; the flaw is fixed in gix-transport 0.58.1. No public proof-of-concept or in-the-wild exploitation is known: EPSS estimates only about 0.3% probability of exploitation within 30 days (22nd percentile) and the CVE is not in CISA KEV.

What to do: Upgrade gix-transport to 0.58.1 or later and rebuild/redeploy any applications that bundle it; audit your dependency tree (e.g., cargo tree / cargo audit) for gix-transport versions <= 0.49.0. As an interim mitigation, avoid attaching HTTP Basic-auth credentials when fetching from user-supplied or otherwise untrusted URLs.