CVE-2026-82255

CVE-2026-82255 is an insufficiently protected credentials flaw (CWE-522) in the curl-based HTTP transport of gitoxide, the Rust Git implementation, affecting versions from 0.25.4 onward. When a remote server answers an authenticated request with a redirect — including a cross-domain redirect or an HTTPS-to-HTTP downgrade — gitoxide validates credentials against the original URL instead of the effective URL after the redirect, so it re-sends the credentials to the redirect target. An attacker who controls or can steer that redirect target (for example a hostile or compromised server, or a downgrade to cleartext HTTP) thereby captures the victim's authentication tokens, with high confidentiality and integrity impact per the CVSS 4.0 score of 7.6 (high). Anyone running an affected gitoxide version that performs authenticated HTTP(S) fetch/push operations through the curl transport is exposed, while purely local operations or unauthenticated fetches are not. No exploitation is currently known: there is no public PoC, the issue is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade gitoxide to a release that fixes CVE-2026-82255 as soon as upstream publishes it (the provided data does not name the fixed version, so check the upstream advisory). Until patched, avoid the curl-based HTTP transport for authenticated fetches, or restrict fetch/push URLs to trusted HTTPS endpoints whose hosts cannot redirect cross-domain or downgrade to HTTP. Audit and rotate credentials or tokens configured for affected fetch hosts, and check CI/build logs for requests that followed redirects while carrying credentials.