CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
A malicious Git server can trigger outbound SMB connections via bundle URIs, exposing NTLM credentials to attackers when bundle URI transfer is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-62960?
CVE-2026-62960 is a high-severity server-side request forgery vulnerability in git-for-windows git, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.
Which versions are affected by CVE-2026-62960?
How do I fix CVE-2026-62960?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-62960 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62960 exists.
Sources
Also known as GHSA-xrpg-8j9v-v282, MINI-2wc5-wj78-pcr4, OESA-2026-3622, OESA-2026-3623, OESA-2026-3733.