CVE-2026-54586: mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex(), mportfetchbootstrapindex(), and mportfetchbundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mport (MidnightBSD Package Manager)to a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running mport versions earlier than 2.7.8 are exposed when they use a repository or package mirror URL over cleartext transport. Exposure can arise from either a configured cleartext URL or mirror data that returns one.
What does an attacker need to exploit it?
An attacker must be in a network position to tamper with traffic between mport and the affected repository or package mirror. They could alter package index or package download traffic, affecting package selection or integrity.
What should be done if an immediate upgrade is not possible?
Avoid configuring non-HTTPS repository or package mirror URLs and do not use mirror data that directs mport to cleartext URLs. Upgrade to mport 2.7.8 when possible, which adds HTTPS enforcement in the affected fetch paths.