CVE-2026-123532 gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123532?
CVE-2026-123532 is a high-severity vulnerability in GitoxideLabs gitoxide, published on 8 Nov 2026.
Official description
gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.
Weakness: CWE-59
Which versions are affected by CVE-2026-123532?
How do I fix CVE-2026-123532?
No fix has been published for CVE-2026-123532 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123532 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123532 exists.
Sources
Also known as AZL-113257, AZL-113296, GHSA-87g4-4rpp-w3f6, GHSA-xw69-xv93-5fjv, UBUNTU-CVE-2026-123532.