{"id":"CVE-2026-54586","summary":"mport permits repository and package mirror fetches over insecure transport","details":"mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.","aliases":["GHSA-v5pv-7gxw-74r5"],"modified":"2026-09-19T08:08:52.944636Z","published":"2026-09-17T16:53:24.229Z","database_specific":{"cwe_ids":["CWE-319","CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54586.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54586.json"},{"type":"ADVISORY","url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54586"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/121"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/midnightbsd/mport","events":[{"introduced":"0"},{"fixed":"9b4d0f9192b243ee32266afa36dce430b257b921"},{"fixed":"899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.8","2.6.7","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.1","2.5.0","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.1","2.4.0","2.3.0","2.2.9.1","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.2","2.0.1","2.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"libmport/fetch.c","function":"mport_fetch_bootstrap_index"},"deprecated":false,"digest":{"function_hash":"330651263378550351431824170733181136631","length":1003},"id":"CVE-2026-54586-5f5f5dfd","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921"},{"id":"CVE-2026-54586-948fd721","signature_type":"Line","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921","target":{"file":"libmport/fetch.c"},"deprecated":false,"digest":{"line_hashes":["87202371787256375580825701242587534325","292710471633789271015363719567996223911","330205345980952116775422996878523744684","5049253250506327890800463441251290769","1143066104045737858950436484863772041","312248038583867603601548935039583487334","27273291721498388546853151044472796016","213132730140500568569703997021576152450","165241533151188968352001776780176613596","202439467465724316123857185243160157111","16188201062170795790242608177059995033","139370752144087896306756922554741053213","1143066104045737858950436484863772041","111722753616255393028516134137972750258","62902174085889379286499466319697240953","304248851722277412317219938941658749585","52734687378637338078395584772832694213","13732629114859323110375832084662696186","101776727208500131752168413408106379398"],"threshold":0.9}},{"id":"CVE-2026-54586-edbcd806","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921","target":{"file":"libmport/fetch.c","function":"mport_fetch_bundle"},"deprecated":false,"digest":{"function_hash":"24642465677067625115430151991407919370","length":1083}},{"digest":{"function_hash":"280546841546949863632380859921918464654","length":1727},"id":"CVE-2026-54586-f053cfa2","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921","target":{"file":"libmport/fetch.c","function":"mport_fetch_index"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54586.json","vanir_signatures_modified":"2026-09-19T08:08:52Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}