CVE-2026-54586

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54586
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54586.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54586
Aliases
  • GHSA-v5pv-7gxw-74r5
Published
2026-09-17T16:53:24Z
Modified
2026-09-19T08:08:52Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
mport permits repository and package mirror fetches over insecure transport
Details

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-319",
        "CWE-345"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54586.json"
}
References

Affected packages

Git / github.com/midnightbsd/mport

Affected ranges

Type
GIT
Repo
https://github.com/midnightbsd/mport
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9b4d0f9192b243ee32266afa36dce430b257b921
Fixed
899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
2.0.1
2.0.2
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.9.1
2.3.0
2.4.0
2.4.1
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.7
2.6.8
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54586.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "330651263378550351431824170733181136631",
            "length": 1003
        },
        "id": "CVE-2026-54586-5f5f5dfd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921",
        "target": {
            "file": "libmport/fetch.c",
            "function": "mport_fetch_bootstrap_index"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "87202371787256375580825701242587534325",
                "292710471633789271015363719567996223911",
                "330205345980952116775422996878523744684",
                "5049253250506327890800463441251290769",
                "1143066104045737858950436484863772041",
                "312248038583867603601548935039583487334",
                "27273291721498388546853151044472796016",
                "213132730140500568569703997021576152450",
                "165241533151188968352001776780176613596",
                "202439467465724316123857185243160157111",
                "16188201062170795790242608177059995033",
                "139370752144087896306756922554741053213",
                "1143066104045737858950436484863772041",
                "111722753616255393028516134137972750258",
                "62902174085889379286499466319697240953",
                "304248851722277412317219938941658749585",
                "52734687378637338078395584772832694213",
                "13732629114859323110375832084662696186",
                "101776727208500131752168413408106379398"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54586-948fd721",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921",
        "target": {
            "file": "libmport/fetch.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24642465677067625115430151991407919370",
            "length": 1083
        },
        "id": "CVE-2026-54586-edbcd806",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921",
        "target": {
            "file": "libmport/fetch.c",
            "function": "mport_fetch_bundle"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "280546841546949863632380859921918464654",
            "length": 1727
        },
        "id": "CVE-2026-54586-f053cfa2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921",
        "target": {
            "file": "libmport/fetch.c",
            "function": "mport_fetch_index"
        }
    }
]
vanir_signatures_modified 
"2026-09-19T08:08:52Z"