CVE-2026-54581highCWE-345CWE-347

CVE-2026-54581: fallo de gravedad alta en MidnightBSD mport

mport bootstrap index fetch can continue after hash verification failure

Publicada el

Seguir esta CVE+ Monitorear mport

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 0.2%
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
MidnightBSD · mport
CVEs relacionadas — MidnightBSD mport

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54582MEDIUMmport package installation can overwrite existing unmanaged or differently owned filesEPSS 0.6%CVE-2026-54585MEDIUMmport sample file handling can write outside the configured rootEPSS 0.5%CVE-2026-54583HIGHmport package bundle downloads allow unsafe destination filenamesEPSS 0.5%CVE-2026-54584MEDIUMmport trusts environment-controlled temporary directories in privileged metadata extractionEPSS 0.5%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2026-54577LOWmport audit can inspect the wrong package when options are presentEPSS 0.2%