CVE-2026-5222

The record

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

Affected packages

Related vulnerabilities

• CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that… CWE-647
• CVE-2026-15970 Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an… CWE-647
• CVE-2026-8384 In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an… CWE-647
• CVE-2026-59731 Astro is a web framework for content-driven websites. CWE-647
• CVE-2025-9909 A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation… CWE-647
• CVE-2025-66202 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CWE-647