{"id":"CVE-2026-123532","kind":"vulnerability","aliases":["CVE-2026-123532"],"related":[],"title":"gitoxide: Windows checkout leaks NTLM credentials via crafted UNC symlinks","description":"gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.","summary":"gitoxide's gix-fs crate, before 0.24.1, follows UNC symlink targets in a crafted repository when a victim checks it out on Windows with symlinks enabled. That triggers SMB authentication, which leaks the victim's username, domain and NTLMv2 hash to an attacker-controlled server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git","gitoxide","package","rust","windows"],"not_affected_if":["git-cli-only","linux-or-macos-only","trusted-repositories-only"],"how_to_check":"- Check the gitoxide version in your Cargo.lock for `gix-fs`; versions below `0.24.1` are affected.\n- Check whether your Windows build or checkout tooling uses gitoxide (`gix`) to clone or check out untrusted repositories with symlinks enabled.","fix":"- gitoxide (gix-fs): `0.24.1`","status":"open","published_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:23:26+00:00","updated_at":"2026-11-08T02:23:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- gitoxide (gix-fs): `0.24.1`","reach":"internet","title":"gitoxide: Windows checkout leaks NTLM credentials via crafted UNC symlinks","impact":"medium","summary":"gitoxide's gix-fs crate, before 0.24.1, follows UNC symlink targets in a crafted repository when a victim checks it out on Windows with symlinks enabled. That triggers SMB authentication, which leaks the victim's username, domain and NTLMv2 hash to an attacker-controlled server.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","gitoxide","windows","git"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker captures victim's NTLMv2 hash and username via SMB","analyst_note":"","how_to_check":"- Check the gitoxide version in your Cargo.lock for `gix-fs`; versions below `0.24.1` are affected.\n- Check whether your Windows build or checkout tooling uses gitoxide (`gix`) to clone or check out untrusted repositories with symlinks enabled.","plain_action":"","needs_analyst":false,"not_affected_if":["linux-or-macos-only","git-cli-only","trusted-repositories-only"],"who_is_affected":"Teams that build tools on the gitoxide crates, or run them, to check out repositories on Windows with symlinks enabled, especially untrusted repositories. Systems that only use git's own CLI, or that work on Linux and macOS only, are not affected by this description. Upgrading the gix-fs dependency to 0.24.1 or later removes the exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4318,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123532':13A,16A '-2026':12A,15A '0.24.1':29B,75C 'allow':82C 'attack':66B,84C 'attacker-control':65B 'authent':52B,123C 'call':114C 'captur':86C 'check':41B,101C 'checkout':3A 'contain':76C 'control':67B 'craft':8A,36B,96C 'crate':27B 'creat':113C 'credenti':6A,78C,88C 'cve':11A,14A 'dir':116C 'disclosur':79C 'domain':59B,128C 'enabl':48B,109C 'follow':30B 'fs':26B,71C,111C 'git':17B 'gitoxid':1A,18B,22B,73C 'gix':25B,70C,110C 'gix-f':24B,69C 'hash':62B,131C 'leak':4A,54B,125C 'ntlm':5A,87C 'ntlmv2':61B,130C 'packag':19B 'remot':83C 'repositori':37B,97C,104C 'rust':20B 'server':68B 'smb':51B,122C 'suppli':90C 'symlink':10A,32B,47B,92C,108C,112C 'target':33B,93C,120C 'trigger':50B,121C 'unc':9A,31B,91C,119C 'usernam':58B,127C 'via':7A 'victim':40B,56B,100C 'vulner':80C 'window':2A,21B,45B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams that build tools on the gitoxide crates, or run them, to check out repositories on Windows with symlinks enabled, especially untrusted repositories. Systems that only use git's own CLI, or that work on Linux and macOS only, are not affected by this description. Upgrading the gix-fs dependency to 0.24.1 or later removes the exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["git","gitoxide","high","package","rust","windows"],"campaign_type":null,"search_a":"'-123532':13A,16A '-2026':12A,15A 'checkout':3A 'craft':8A 'credenti':6A 'cve':11A,14A 'gitoxid':1A 'leak':4A 'ntlm':5A 'symlink':10A 'unc':9A 'via':7A 'window':2A","search_b":"'0.24.1':29B 'attack':66B 'attacker-control':65B 'authent':52B 'check':41B 'control':67B 'craft':36B 'crate':27B 'domain':59B 'enabl':48B 'follow':30B 'fs':26B 'git':17B 'gitoxid':18B,22B 'gix':25B 'gix-f':24B 'hash':62B 'leak':54B 'ntlmv2':61B 'packag':19B 'repositori':37B 'rust':20B 'server':68B 'smb':51B 'symlink':32B,47B 'target':33B 'trigger':50B 'unc':31B 'usernam':58B 'victim':40B,56B 'window':21B,45B","search_c":"'0.24.1':75C 'allow':82C 'attack':84C 'authent':123C 'call':114C 'captur':86C 'check':101C 'contain':76C 'craft':96C 'creat':113C 'credenti':78C,88C 'dir':116C 'disclosur':79C 'domain':128C 'enabl':109C 'fs':71C,111C 'gitoxid':73C 'gix':70C,110C 'gix-f':69C 'hash':131C 'leak':125C 'ntlm':87C 'ntlmv2':130C 'remot':83C 'repositori':97C,104C 'smb':122C 'suppli':90C 'symlink':92C,108C,112C 'target':93C,120C 'trigger':121C 'unc':91C,119C 'usernam':127C 'victim':100C 'vulner':80C 'window':106C","first_public_at":"2026-10-22T14:01:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123532","severity":null,"published_at":"2026-11-08T02:16:43+00:00","modified_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99213,"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-xw69-xv93-5fjv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T14:01:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99214,"url":"https://www.vulncheck.com/advisories/gix-fs-before-0.24.1-ntlm-credential-disclosure-via-windows-symlink-unc-probe","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}