CVE-2026-54581: mport bootstrap index fetch can continue after hash verification failure
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mport (MidnightBSD Package Manager)to a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to alter bootstrap index content or interfere with the transport path used to retrieve it. This includes a compromised package mirror or a network attacker positioned to modify the fetch.
Are installations using the fixed release affected?
No. The issue is fixed in mport version 2.7.8; the affected behavior applies to versions prior to 2.7.8.
What is the security impact of a failed verification in an affected version?
mport may continue as though the bootstrap index fetch succeeded even when its hash is missing or invalid. This can allow use of an unverified or tampered bootstrap package index.