CVE-2026-5222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5222", "assignerOrgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "state": "PUBLISHED", "assignerShortName": "rust", "dateReserved": "2026-03-31T12:07:40.168Z", "datePublished": "2026-05-25T08:54:56.348Z", "dateUpdated": "2026-05-26T14:43:10.019Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "shortName": "rust", "dateUpdated": "2026-05-25T08:54:56.348Z"}, "title": "Cargo can be coerced to share credentials between registries", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-647", "description": "CWE-647 Use of Non-Canonical URL paths for authorization decisions", "type": "CWE"}]}], "affected": [{"vendor": "Rust", "product": "Cargo", "collectionURL": "https://crates.io", "packageName": "cargo", "repo": "https://github.com/rust-lang/cargo", "modules": ["sparse index"], "versions": [{"status": "affected", "version": "1.68.0", "lessThan": "1.96.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\u00a0The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.&nbsp;The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.</div>"}]}], "references": [{"url": "https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5222/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rust-lang/cargo/pull/17031", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Rust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Rust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo."}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T14:36:59.303136Z", "id": "CVE-2026-5222", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T14:43:10.019Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T14:36:59.303136Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T14:43:04.959Z"}}], "cna": {"title": "Cargo can be coerced to share credentials between registries", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/rust-lang/cargo", "vendor": "Rust", "modules": ["sparse index"], "product": "Cargo", "versions": [{"status": "affected", "version": "1.68.0", "lessThan": "1.96.0", "versionType": "semver"}], "packageName": "cargo", "collectionURL": "https://crates.io", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Rust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.", "supportingMedia": [{"type": "text/html", "value": "Rust 1.96, to be released on May 28th, 2026, will update Cargo to only strip the `.git` suffix from registry URLs using the git protocol. No mitigations are available for users of older versions of Cargo.", "base64": false}]}], "references": [{"url": "https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5222/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/rust-lang/cargo/pull/17031", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\u00a0The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.", "supportingMedia": [{"type": "text/html", "value": "<div>Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.&nbsp;The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-647", "description": "CWE-647 Use of Non-Canonical URL paths for authorization decisions"}]}], "providerMetadata": {"orgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "shortName": "rust", "dateUpdated": "2026-05-25T08:54:56.348Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5222", "state": "PUBLISHED", "dateUpdated": "2026-05-26T14:43:10.019Z", "dateReserved": "2026-03-31T12:07:40.168Z", "assignerOrgId": "986d4109-89ea-491f-99fd-a8e4803919bd", "datePublished": "2026-05-25T08:54:56.348Z", "assignerShortName": "rust"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crates.io", "defaultStatus": "unaffected", "modules": ["sparse index"], "packageName": "cargo", "product": "Cargo", "repo": "https://github.com/rust-lang/cargo", "vendor": "Rust", "versions": [{"lessThan": "1.96.0", "status": "affected", "version": "1.68.0", "versionType": "semver"}]}], "source": "986d4109-89ea-491f-99fd-a8e4803919bd"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*", "matchCriteriaId": "143A0C07-6AA8-4711-A789-152DA178214C", "versionEndExcluding": "1.96.0", "versionStartIncluding": "1.68.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.\u00a0The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack."}, {"lang": "es", "value": "Cargo entre 1.68 y 1.96 normaliz\u00f3 incorrectamente las URL de registros de terceros utilizando el protocolo de \u00edndice disperso. Si un proveedor de alojamiento permit\u00eda que se alojaran m\u00faltiples registros con nombres arbitrarios dentro del mismo dominio, un atacante capaz de publicar crates en un registro podr\u00eda obtener las credenciales de otros usuarios del mismo registro. La gravedad de la vulnerabilidad es baja, debido a los requisitos extremadamente espec\u00edficos necesarios para lograr el ataque."}], "id": "CVE-2026-5222", "lastModified": "2026-07-23T17:10:00.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "986d4109-89ea-491f-99fd-a8e4803919bd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5222", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T14:36:59.303136Z", "version": "2.0.3"}}]}, "published": "2026-05-25T10:16:15.273", "references": [{"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Vendor Advisory"], "url": "https://blog.rust-lang.org/2026/05/25/cve-2026-5222/"}, {"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rust-lang/cargo/pull/17031"}, {"source": "986d4109-89ea-491f-99fd-a8e4803919bd", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s"}], "sourceIdentifier": "986d4109-89ea-491f-99fd-a8e4803919bd", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-647"}], "source": "986d4109-89ea-491f-99fd-a8e4803919bd", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.68.0,1.96.0)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 80.0, "source": "matching"}]}, "original": {"product": "Cargo", "source": "cna", "vendor": "Rust"}, "product": "cargo", "vendor": "rust-lang"}], "created": "2026-05-25T10:30:22.990362+00:00", "updated": "2026-05-25T11:30:23.830861+00:00", "vendors": ["rust-lang", "rust-lang$PRODUCT$cargo"]}