Security Advisory for Cargo (CVE-2026-5222)

Cargo's sparse index URL normalization enables credential theft.

• •Cargo removed .git suffixes from sparse URLs, treating https://example.com/index and https://example.com/index.git identically
• •Attackers could configure malicious registries to steal Cargo tokens
• •Affects Rust 1.68–1.95
• •Rust 1.96 (May 28, 2026) fixes by only stripping .git from git protocol URLs
• •Requires multiple registries on same domain with attacker publish/upload permissions

This summary was automatically generated by AI based on the original article and may not be fully accurate.