CVE-2026-54586

UNKNOWN 0.0

mport permits repository and package mirror fetches over insecure transport

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

CWE	CWE-319 CWE-345
Vendor	midnightbsd
Product	mport
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for midnightbsd mport

Be the first to know when new unknown vulnerabilities affecting midnightbsd mport are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

MidnightBSD / mport

< 2.7.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MidnightBSD/mport/security/advisories/GHSA-v5pv-7gxw-74r5 github.com: https://github.com/MidnightBSD/mport/pull/121 github.com: https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921 github.com: https://github.com/MidnightBSD/mport/releases/tag/2.7.8