CVE-2026-54577: mport audit can inspect the wrong package when options are present
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted localargv and localargc values but passed the original argument entry to auditpackage(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mport/mportto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who is affected by this issue?
Operators and automation using mport versions before 2.7.8 may be affected when invoking the audit command with an option, such as -r, before a package name. The impact is an incorrect audit target and a potentially false-negative or otherwise useless audit result.
What conditions are needed to trigger the incorrect audit behavior?
The audit command must be run with options preceding the intended package name. Under that invocation pattern, stale option-parsing state and use of the unadjusted argument can cause the option token to be audited instead of the requested package.
How can I mitigate the issue if I cannot immediately upgrade?
Avoid placing audit-command options before the package name, since this is the invocation pattern described as causing the wrong package to be inspected. Treat prior audit results produced with options before a package name as potentially unreliable and rerun them without that pattern.
What version fixes the problem?
The issue is fixed in mport version 2.7.8. The correction resets optind and optreset before using the adjusted local arguments.