CVE-2026-5222: Cargo can be coerced to share credentials between registries
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5222?
The severity of CVE-2026-5222 is rated as 15.
How do I fix CVE-2026-5222?
To fix CVE-2026-5222, upgrade to Rust Cargo version 1.96 or later when it is released on May 28th, 2026.
What versions of Cargo are affected by CVE-2026-5222?
Cargo versions from 1.68 to 1.96 are affected by CVE-2026-5222.
What kind of attack does CVE-2026-5222 enable?
CVE-2026-5222 allows an attacker to coerce Cargo into sharing credentials between different registries.
Is there a workaround for CVE-2026-5222?
No mitigations are available for users of older versions of Cargo prior to the release of version 1.96.