CVE-2026-5222 Details

A vulnerability in Cargo versions 1.68 prior to 1.96 has been identified, where the normalization of URLs for third-party registries using the sparse index protocol was handled incorrectly. This issue arises when a hosting provider permits multiple registries to be hosted under the same domain with arbitrary names. An attacker who can publish crates in a registry could potentially access the credentials of other users within the same registry. The vulnerability's severity is considered low, given the very specific conditions required for exploitation.

Users can update to Cargo version 1.96 or later, which addresses this vulnerability by correcting the URL normalization process for registries using the git protocol. No remediation is available for users of earlier Cargo versions.