CVE-2026-82255

Fixed in a distro release EPSS <1%CVSS 6.8

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

Published 2026-08-28 · CVE record · OSV

Products: GitoxideLabs gitoxide

Fixed upstream

Distro releases