high · CVSS v3 6.5 · CVSS v4 7.1

CVE-2026-123532

The CVE-2026-123532 vulnerability in gitoxide’s gix-fs component allows remote attackers to capture NTLM credentials when a Windows user che

Overview

The CVE-2026-123532 vulnerability in gitoxide’s gix-fs component allows remote attackers to capture NTLM credentials when a Windows user checks out a repository with symlinks enabled. By supplying UNC symlink targets, the library triggers SMB authentication, leaking the username, domain, and NTLMv2 hash. This flaw exposes sensitive credential information during normal repository operations.

Description

gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.

Impact

Confidentiality is compromised as attackers can obtain NTLM credentials used for Windows authentication. Integrity of credential data is at risk if hashes are reused. Availability is not directly affected. Defenders are primarily Windows hosts and CI/CD pipelines that use gitoxide with symlink support.

Remediation

Upgrade gitoxide to version 0.24.1 or later where the issue is fixed. Disable symlink support in gitoxide or configure it to reject UNC symlink targets. Monitor SMB authentication logs for unexpected credential requests and apply network segmentation to limit SMB exposure.

Risk context

The vulnerability is rated high severity with CVSS v3 score 6.5 and CVSS v4 score 7.1. No EPSS data is available, but the high severity indicates a moderate to high urgency for patching and mitigation.

Affected products

  • gitoxide
  • gitoxide gix-fs
  • gitoxide 0.24.1

Scores

Severity
high
CVSS v2
7.8
CVSS v3
6.5
CVSS v4
7.1
EPSS
—

credential-disclosure gitoxide NTLM SMB symlink Windows high-severity

← All CVEs

Related CVEs

high

CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.

View analysis

high

CVE-2026-123497

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

View analysis

high

CVE-2026-123501

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.

View analysis

high

CVE-2026-123512

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing attackers with log access to replay tokens and compromise accounts. This flaw can lead to unauthorized account takeover or deletion. Defenders should update or patch the application immediately.

View analysis