CVE-2026-54581highCWE-345CWE-347

CVE-2026-54581: falha de alta gravidade em MidnightBSD mport

mport bootstrap index fetch can continue after hash verification failure

Publicada em

Seguir esta CVE+ Monitorar mport

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.2%
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
MidnightBSD · mport
CVEs relacionadas — MidnightBSD mport

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54582MEDIUMmport package installation can overwrite existing unmanaged or differently owned filesEPSS 0.6%CVE-2026-54585MEDIUMmport sample file handling can write outside the configured rootEPSS 0.5%CVE-2026-54583HIGHmport package bundle downloads allow unsafe destination filenamesEPSS 0.5%CVE-2026-54584MEDIUMmport trusts environment-controlled temporary directories in privileged metadata extractionEPSS 0.5%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2026-54577LOWmport audit can inspect the wrong package when options are presentEPSS 0.2%