# CVE-2026-5222: Cargo can be coerced to share credentials between registries

CVE-2026-5222 is fixed in 40 products on 1 platform, first by DEBIAN-CVE-2026-5222, released May 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-5222
- Priority: Routine
- CVSS: 6.5 (Low)
- EPSS: 0.0048
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 25, 2026
- Weakness: Use of Non-Canonical URL Paths for Authorization Decisions
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5222

## Description

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cargo-c Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | cargo-c amzn 2023 | 0.10.19-1.amzn2023.0.3 | [ALAS2023-2026-1872](https://patchblox.com/security/data/fix/linux/alas2023-2026-1872.md) | Jun 22, 2026 |
| Linux | cargo-c-debuginfo Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | cargo-c-debuginfo amzn 2023 | 0.10.19-1.amzn2023.0.3 | [ALAS2023-2026-1872](https://patchblox.com/security/data/fix/linux/alas2023-2026-1872.md) | Jun 22, 2026 |
| Linux | rust-anstyle-hyperlink Fedora 43 | 1.0.2-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-hyperlink+default-devel Fedora 43 | 1.0.2-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-hyperlink+file-devel Fedora 43 | 1.0.2-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-hyperlink+std-devel Fedora 43 | 1.0.2-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-hyperlink-devel Fedora 43 | 1.0.2-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-progress Fedora 43 | 0.1.4-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-progress+default-devel Fedora 43 | 0.1.4-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-progress+std-devel Fedora 43 | 0.1.4-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-anstyle-progress-devel Fedora 43 | 0.1.4-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo Debian 14 | 0.91.0-3 | [DEBIAN-CVE-2026-5222](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5222.md) | May 25, 2026 |
| Linux | rust-cargo Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo+default-devel Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo+http-transport-curl-devel Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo+http-transport-reqwest-devel Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo+openssl-devel Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-c Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-c+default-devel Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-c-debugsource Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-c-debugsource amzn 2023 | 0.10.19-1.amzn2023.0.3 | [ALAS2023-2026-1872](https://patchblox.com/security/data/fix/linux/alas2023-2026-1872.md) | Jun 22, 2026 |
| Linux | rust-cargo-c-devel Fedora 43 | 0.10.24-2.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-credential-libsecret Fedora 43 | 0.5.8-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-credential-libsecret+default-devel Fedora 43 | 0.5.8-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-credential-libsecret-devel Fedora 43 | 0.5.8-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-devel Fedora 43 | 0.98.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util Fedora 43 | 0.2.30-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util+default-devel Fedora 43 | 0.2.30-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-devel Fedora 43 | 0.2.30-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-schemas Fedora 43 | 0.14.1-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-schemas+default-devel Fedora 43 | 0.14.1-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-schemas-devel Fedora 43 | 0.14.1-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-terminal Fedora 43 | 0.1.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-terminal+default-devel Fedora 43 | 0.1.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-cargo-util-terminal-devel Fedora 43 | 0.1.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-crates-io Fedora 43 | 0.41.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-crates-io+default-devel Fedora 43 | 0.41.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-crates-io-devel Fedora 43 | 0.41.0-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-rustfix Fedora 43 | 0.9.7-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-rustfix+default-devel Fedora 43 | 0.9.7-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rust-rustfix-devel Fedora 43 | 0.9.7-1.fc43 | [FEDORA-2026-CE685F40FE](https://patchblox.com/security/data/fix/linux/fedora-2026-ce685f40fe.md) | Aug 20, 2026 |
| Linux | rustc Debian 13.5 (trixie) | 1.85.1+dfsg1-1+deb13u1 | [DEBIAN-CVE-2026-5222](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5222.md) | May 25, 2026 |
| Linux | rustc Debian 14 | 1.95.0+dfsg1-2 | [DEBIAN-CVE-2026-5222](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5222.md) | May 25, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.