gitoxide gix-transport CVE-2026-82255

Exploitation requires all of the following: the victim must be using gitoxide with the curl transport backend specifically (not the reqwest backend, which is unaffected); the victim must have HTTP credentials configured for the target repository (password, token, or other HTTP auth); the victim must initiate a git operation (clone, fetch, push) against a server the attacker can influence to return a 302 redirect; and the attacker must control or be able to serve responses from the redirect target. Cross-domain redirects (e.g., legitimate.com redirecting to attacker.com) and HTTPS-to-HTTP downgrades are both viable redirect types. Exploitation is limited by the need for attacker control over the redirect path - passive network observers cannot exploit this without the ability to inject redirect responses.

The CVSS 4.0 score of 7.6 with AV:N/AC:H/AT:P/PR:N/UI:P reflects a real but conditional threat. AC:H and AT:P are accurate - the attacker must either control a server capable of issuing the redirect or occupy a network position to inject one, and the victim must have credentials configured and must initiate a clone or fetch operation. VC:H and VI:H are justified because stolen git credentials typically provide full repository read and write access, enabling source code exfiltration and supply chain tampering. There is no EPSS score in the available data; the absence from CISA KEV and lack of public exploit code suggest opportunistic exploitation is not yet occurring. The attack is non-trivial: it requires either compromising a git hosting infrastructure or mounting an active redirect attack, reducing the realistic threat population. However, for organizations using gitoxide with the curl backend and cloning from untrusted or external repositories, the credential theft risk is concrete and the impact is high. The reqwest backend provides a natural architectural mitigation for users who can switch.

An attacker operates a malicious git server or compromises a legitimate one, configured to issue a 302 redirect from the expected repository URL to an attacker-controlled endpoint. When a developer using gitoxide with the curl backend runs git clone https://legitimate.com/repo with credentials stored in their git config or credential helper, the curl backend follows the redirect and stores the attacker's host as the new base URL. All subsequent POST requests - including POST /git-upload-pack - are rewritten to the attacker's server and sent with the victim's Authorization header attached, delivering the plaintext credentials or tokens to the attacker.