EUVD-2026-82318Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because a man-in-the-middle or compromised-mirror position is required; PR:N/UI:N as no auth or interaction is needed; C:N per no confidentiality impact, I:H for tampered package index, A:L for possible package breakage.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
AnalysisAI
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because the hash-check failure path in mport_fetch_bootstrap_index() (libmport/fetch.c) fails to preserve a fatal result when the fetched index has a missing or invalid hash. An unauthenticated attacker who controls the package mirror or occupies an on-path/man-in-the-middle network position (the CVSS v4.0 AT:P prerequisite) can therefore have mport proceed with an unverified index, corrupting the integrity of packages the system later trusts and installs - the vendor vector scores 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L), emphasizing high integrity impact with no confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be able to alter the bootstrap index content or its transport path - i.e., control of a MidnightBSD package mirror or a man-in-the-middle/on-path network position between the victim and the mirror (this is the AT:P attack requirement). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L, score 8.3) correctly characterizes this as an integrity-centric flaw: no confidentiality impact (VC:N), high integrity impact (VI:H) from installing a tampered package index, and low availability impact (VA:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade mport to version 2.7.8 or later - the vendor-released patch that fixes CVE-2026-54581 - using the release at https://github.com/MidnightBSD/mport/releases/tag/2.7.8 and the vendor advisory GHSA-895r-rv8j-7g23; a point upgrade of mport itself is low-risk but must be performed before any further bootstrap index refresh from an untrusted path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MidnightBSD hosts running mport versions prior to 2.7.8 and confirm which package mirrors and network paths they use; temporarily restrict mport index retrieval to internally controlled mirrors reached over authenticated TLS, and where operationally feasible suspend unattended bootstrap/index fetching until the path is validated. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Midnightbsd
View allA memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 th
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malici
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who con
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker s
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file ha
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who alrea
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already w
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in th
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, i
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure,
Share
External POC / Exploit Code
Leaving vuln.today