CVE-2026-5222 Cargo can be coerced to share credentials between registries

What is CVE-2026-5222?

CVE-2026-5222 is a low-severity vulnerability in Rust Cargo, published on 25 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

Weakness: CWE-647

Which versions are affected by CVE-2026-5222?

2 open source packages ship an affected version, including cargo. It affects 1 product.

Products include Rust-Lang Cargo.

How do I fix CVE-2026-5222?

Upgrade cargo to 0.97.0 or later.

Is CVE-2026-5222 being exploited?

There is no known exploitation of CVE-2026-5222 in the wild and no public exploit code.

Other vulnerabilities in Rust Cargo

• CVE-2026-5223 Crates in third party registries can override the cached source of other crates Medium 6.5
• CVE-2022-46176 Cargo did not verify SSH host keys Medium 5.3
• CVE-2022-36114 Extracting malicious crates can fill the file system Medium 4.8
• CVE-2022-36113 Extracting malicious crates can corrupt arbitrary files Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-5222, AZL-88275, AZL-88281, BELL-CVE-2026-5222, DEBIAN-CVE-2026-5222, GHSA-p688-r7jv-fm6f and 2 more.