CVE-2026-54581highCWE-345CWE-347

CVE-2026-54581: high-severity vulnerability in MidnightBSD mport

mport bootstrap index fetch can continue after hash verification failure

Published

Follow this CVE+ Monitor mport

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.2%
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
MidnightBSD · mport
Related CVEs — MidnightBSD mport

In the same product, most dangerous first.

CVE-2026-54582MEDIUMmport package installation can overwrite existing unmanaged or differently owned filesEPSS 0.6%CVE-2026-54585MEDIUMmport sample file handling can write outside the configured rootEPSS 0.5%CVE-2026-54583HIGHmport package bundle downloads allow unsafe destination filenamesEPSS 0.5%CVE-2026-54584MEDIUMmport trusts environment-controlled temporary directories in privileged metadata extractionEPSS 0.5%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2026-54577LOWmport audit can inspect the wrong package when options are presentEPSS 0.2%