CVE-2026-82255: Gitoxidelabs Gitoxide

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

Affected products

• Gitoxidelabs Gitoxide: from 0.25.4, up to and including 0.55.0

Published 2026-08-28. Last modified 2026-09-30.