Medium severity · published Sep 17, 2026
CVE-2026-54586
mport permits repository and package mirror fetches over insecure transport
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
mport · MidnightBSD
< 2.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54586
github.com
https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921
github.com
https://github.com/MidnightBSD/mport/pull/121
github.com
https://github.com/MidnightBSD/mport/releases/tag/2.7.8
github.com
https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5
More from mport
8.3
CVE-2026-54580
mport index decompression can leave partial or corrupt index data after zstd failures
8.3
CVE-2026-54583
mport package bundle downloads allow unsafe destination filenames
8.3
CVE-2026-54581
mport bootstrap index fetch can continue after hash verification failure
6.0
CVE-2026-54585
mport sample file handling can write outside the configured root
6.0
CVE-2026-54582
mport package installation can overwrite existing unmanaged or differently owned files