Rust Cargo CVE-2026-5222

Three specific conditions must simultaneously hold: (1) the victim must be using a third-party registry configured with the sparse index protocol (i.e., the registry URL begins with sparse+https://), not the default crates.io or a git-protocol registry; (2) the registry hosting provider must allow multiple distinct registries to be hosted under arbitrary path names within the same domain (a multi-tenant hosting model); and (3) an attacker must be able to register and control a registry on that same hosting provider whose path differs from the victim's registry only by the presence or absence of a .git suffix. Exploitation additionally requires the victim to perform a Cargo operation that causes registry credential submission (UI:P). Exploitation is limited by the rarity of this exact hosting configuration in practice. Organizations using self-hosted, single-tenant, or dedicated-domain sparse registries are not exposed.

All available signals converge on low real-world risk. The CVSS 4.0 score is 2.3, with AT:P (attack requirements: partial) directly reflecting the niche infrastructure conditions required. UI:P (user participation required) adds a further barrier. EPSS is 0.04% at the 12th percentile, indicating near-negligible automated exploitation likelihood. SSVC assesses exploitation as none and the attack as not automatable with only partial technical impact. The vulnerability is not listed in CISA KEV. The vendor's own advisory characterizes severity as low due to extremely niche requirements. The confidentiality impact is limited to registry credentials (VC:L, SC:L), with no integrity or availability impact. There is no conflict between signals - CVSS, EPSS, SSVC, and vendor assessment are all self-consistent. This is not a prioritization candidate for most organizations; risk is meaningful only to teams using sparse-protocol third-party registries hosted on multi-tenant providers that allow arbitrary registry path naming.

An attacker who has publish access to a registry named my-registry hosted at sparse+https://shared-host.example.com/my-registry on a multi-tenant registry hosting provider could exploit this if a victim organization uses a registry at sparse+https://shared-host.example.com/my-registry.git. Cargo 1.68-1.96 strips the .git suffix during canonicalization, making both URLs resolve to the same identifier and potentially causing the victim's registry credentials to be sent to the attacker's endpoint. The victim must perform a Cargo operation (such as cargo update or cargo fetch) that triggers a registry request for the attack to succeed.