CVE-2026-54586

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

CVSS

No CVSS.

References

Link	Resource
https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921
https://github.com/MidnightBSD/mport/pull/121
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5

Configurations

No configuration.

History

17 Sep 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:16

Updated : 2026-09-21 21:17

NVD link : CVE-2026-54586

Mitre link : CVE-2026-54586

CVE.ORG link : CVE-2026-54586

JSON object : View

Products Affected

No product.

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-54586", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54586", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T20:57:25.913923Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MidnightBSD", "product": "mport", "versions": [{"status": "affected", "version": "< 2.7.8"}]}]}], "published": "2026-09-17T17:16:43.883", "references": [{"url": "https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921", "source": "security-advisories@github.com"}, {"url": "https://github.com/MidnightBSD/mport/pull/121", "source": "security-advisories@github.com"}, {"url": "https://github.com/MidnightBSD/mport/releases/tag/2.7.8", "source": "security-advisories@github.com"}, {"url": "https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8."}], "lastModified": "2026-09-21T21:17:04.840", "sourceIdentifier": "security-advisories@github.com"}