---
id: CVE-2026-53586
title: >-
  libgit2 is a portable C implementation of the Git core methods provided as a
  linkable library with a solid API, allowing to build Git functionality into
  your application
summary: >-
  libgit2 is a portable C implementation of the Git core methods provided as a
  linkable library with a solid API, allowing to build Git functionality into
  your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in
  src/libgi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-522
  - CWE-601
published: '2026-08-20'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:19:49.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53586'
references:
  - url: >-
      https://github.com/libgit2/libgit2/commit/07de6a7e438f95ac9a6efd3222a82117e871ed27
    label: security-advisories@github.com
  - url: >-
      https://github.com/libgit2/libgit2/commit/af2b29ad0a74d5bac9751376879ddaf848136d3b
    label: security-advisories@github.com
  - url: >-
      https://github.com/libgit2/libgit2/commit/c1507abc44647b3acd832a33a5b1c8c9f5ba8821
    label: security-advisories@github.com
  - url: 'https://github.com/libgit2/libgit2/releases/tag/v1.8.6'
    label: security-advisories@github.com
  - url: 'https://github.com/libgit2/libgit2/releases/tag/v1.9.5'
    label: security-advisories@github.com
  - url: 'https://github.com/libgit2/libgit2/security/advisories/GHSA-2889-x8f6-mc4x'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00476
epssPercentile: 0.38433
ingestedAt: '2026-09-09T21:22:45.545Z'
---

## Overview

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.