CVE-2026-54581

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.

• CWE-345
• CWE-347

• https://github.com/MidnightBSD/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e
• https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d
• https://github.com/MidnightBSD/mport/pull/134
• https://github.com/MidnightBSD/mport/pull/135
• https://github.com/MidnightBSD/mport/releases/tag/2.7.8
• https://github.com/MidnightBSD/mport/security/advisories/GHSA-895r-rv8j-7g23

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54576mport is the MidnightBSD Package Manager. Prior to 2.7.8, do…5.8
• CVE-2026-54577mport is the MidnightBSD Package Manager. Prior to 2.7.8, th…2
• CVE-2026-54578mport is the MidnightBSD Package Manager. Prior to 2.7.8, mp…2
• CVE-2026-54579mport is the MidnightBSD Package Manager. Prior to 2.7.8, pi…2.3
• CVE-2026-5458A weakness has been identified in Noelse Individuals & Pro A…3.3
• CVE-2026-54580mport is the MidnightBSD Package Manager. Prior to 2.7.8, li…8.3
• CVE-2026-54582mport is the MidnightBSD Package Manager. Prior to 2.7.8, pa…6
• CVE-2026-54583mport is the MidnightBSD Package Manager. Prior to 2.7.8, li…8.3
• CVE-2026-54584mport is the MidnightBSD Package Manager. mport before 2.7.8…5.3
• CVE-2026-54585mport is the MidnightBSD Package Manager. Prior to 2.7.8, cr…6
• CVE-2026-54586mport is the MidnightBSD Package Manager. Prior to 2.7.8, th…6
• CVE-2026-54587mport is the MidnightBSD Package Manager. Prior to 2.7.8, di…5.8