CVE-2026-54586: midnightbsd mport

Vulnerability summary

CVE-2026-54586 is a medium (CVSS 6.0) vulnerability in midnightbsd mport. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

• CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.