EUVD-2026-82324Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent MITM position plus reliance on a cleartext mirror during an active fetch justifies AV:A and AC:H; package tampering gives I:H, no confidentiality (C:N), minor A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.
AnalysisAI
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker substitute or alter package indexes and bundles that the client then trusts as legitimate. The flaw affects mport releases prior to 2.7.8, whose index and bundle fetch paths in libmport/fetch.c accepted cleartext http:// mirror URLs instead of enforcing HTTPS, giving the issue a CVSS 4.0 base score of 6.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both hold: (1) an mport repository or package mirror URL is configured as, or returned by mirror data as, a cleartext http:// URL (any all-HTTPS configuration is not exploitable, since the bootstrap index path now hard-fails on non-HTTPS); and (2) the attacker occupies an adjacent/on-path network position (AV:A) able to intercept and modify the client-to-mirror traffic during an active index or bundle fetch (AT:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity issue, not a high-urgency emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2.7.8 - upgrade MidnightBSD mport to 2.7.8 or later, which adds the url_is_https() enforcement so non-HTTPS mirrors are skipped in mport_fetch_index() and mport_fetch_bundle() and a non-HTTPS bootstrap index URL is rejected outright (commit 9b4d0f9192b243ee32266afa36dce430b257b921, PR https://github.com/MidnightBSD/mport/pull/121, release https://github.com/MidnightBSD/mport/releases/tag/2.7.8, advisory https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who con
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because th
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, i
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure,
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today