CVE-2026-54586

— UNSCOREDpublic exploit available

Published 2026-09-17 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

Weaknesses

CWE-319, CWE-345

Public exploit & PoC references

https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921
https://github.com/MidnightBSD/mport/pull/121
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5

All references

https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921
https://github.com/MidnightBSD/mport/pull/121
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2025-12999PoC
MEDIUMCVE-2025-36421
MEDIUMCVE-2026-100635PoC
HIGHCVE-2026-100872PoC
LOWCVE-2026-101057PoC
MEDIUMCVE-2026-101278
HIGHCVE-2026-102267PoC
MEDIUMCVE-2026-102275PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.