CVE-2026-32631highCWE-200

CVE-2026-32631: falha de alta gravidade em git-for-windows git

Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers

Publicada em

Seguir esta CVE+ Monitorar git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.3%
Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
git-for-windows · git
CVEs relacionadas — git-for-windows git

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41953HIGHGit clone remote code execution vulnerability in git-for-windowsEPSS 8.0%CVE-2022-24765MEDIUMUncontrolled search for the Git directory in Git for WindowsEPSS 1.0%CVE-2023-25815LOWGit looks for localized messages in the wrong placeEPSS 0.8%CVE-2026-62960HIGHGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on WindowsEPSS 0.5%CVE-2022-31012HIGHGit for Windows' installer can be tricked into executing an untrusted binaryEPSS 0.4%CVE-2023-23618HIGHgitk can inadvertently call executables in the worktreeEPSS 0.4%