CVE-2026-5222 Exploit & Vulnerability Analysis

1. Vulnerability Background

This vulnerability is a URL normalization bug in Cargo's handling of third-party registries that use the sparse index protocol. Cargo versions from 1.68 through 1.96 incorrectly normalized registry URLs, allowing distinct registry endpoints hosted under the same domain to be treated as equivalent.

Why it matters:

• Cargo relies on URI normalization to determine registry identity and to select credentials.
• If two distinct registries share a domain name but differ in path, Cargo could collapse them into a single canonical identity.
• That mistake can cause authentication credentials scoped to one registry to be reused or leaked to another registry hosted on the same domain.

Affected systems/versions:

• Cargo 1.68 through 1.96
• Third-party registries configured with the sparse index protocol
• Environments where a hosting provider allows multiple independent registries under the same domain name but different path segments

The issue is rated low severity because exploitation requires a very specific deployment model: a hosting provider that supports multiple registries under the same host and an attacker with publish access to one registry.

2. Technical Details

Root cause analysis:

• The bug is in Cargo’s sparse registry URL normalization and credential lookup code.
• For sparse index registries, the registry URL includes both host and path.
• The vulnerable logic normalized or canonicalized URLs in a way that stripped or collapsed path components, so https://example.com/registry-a/ and https://example.com/registry-b/ could resolve to the same normalized identifier.
• As a result, Cargo could treat separate registries hosted on the same domain as if they were the same registry.

Attack vector and exploitation conditions:

• The attacker must be able to publish crates to a registry hosted on the same domain as one or more victim registries.
• Users must have configured Cargo to access another registry on that same domain and have credentials stored for it.
• A malicious crate or registry response can trigger Cargo to fetch metadata or follow a registry URL that causes the credential lookup to use the wrong normalized form.
• The attacker can then obtain credentials intended for another registry instance.

Security implications:

• Credential leakage across registry boundaries on the same host.
• Potential unauthorized access to other registry accounts or ability to publish under another registry identity.
• The vulnerability does not appear to allow remote code execution or compromise of arbitrary systems, but it violates the isolation between co-hosted registry instances.

3. Patch Analysis

The provided diff points at src/bin/cargo/commands/test.rs, which is not the code path responsible for sparse registry URL normalization or credential handling. In other words, the supplied patch snippet does not contain the actual security fix.

What should be fixed:

• The sparse registry URL normalization code must preserve the full registry endpoint, including path components.
• Credential lookup must be scoped to the complete canonical registry URL rather than just the domain.
• Any mapping from registry URLs to stored authentication tokens must keep distinct registry namespaces separate, even when they share a host.

How the fix works:

• By ensuring unique registry URLs remain distinct, Cargo avoids reusing credentials across separate registry instances.
• The fix prevents a malicious registry hosted at https://example.com/attacker/ from being treated as the same registry as https://example.com/victim/.
• This restores the proper trust boundary between different registries on the same host.

Security improvements introduced:

• Stronger isolation for third-party sparse-index registries.
• Reduced risk of credential leakage in multi-registry hosting environments.
• Better alignment between registry configuration and credential scoping.

Note: because the provided file is unrelated to the vulnerability, the exact code changes cannot be validated from the supplied diff alone.

4. Proof of Concept (PoC) Guide

Prerequisites:

• Cargo version in the vulnerable range: 1.68 through 1.96.
• A registry host that supports multiple sparse registries under the same domain, e.g.:
  • https://example.com/registry-a/
  • https://example.com/registry-b/
• Attacker ability to publish crates into one registry under that host.
• A victim user with stored credentials for another registry under the same host.

Step-by-step exploitation approach:

1. Configure a victim Cargo client with a registry victim pointing to https://example.com/registry-b/.
2. Store credentials for victim in .cargo/credentials or equivalent.
3. On the attacker-controlled registry https://example.com/registry-a/, publish a crate or registry metadata that causes Cargo to resolve a sparse index URL.
4. When the victim fetches dependencies involving the attacker-controlled registry, Cargo will normalize the registry URLs.
5. If the bug is present, the victim’s victim registry credentials may be sent to the attacker-controlled registry path or included in requests where they should not be.

Expected behavior:

• Cargo treats https://example.com/registry-a/ and https://example.com/registry-b/ as distinct registries.
• Credentials for victim are only sent to https://example.com/registry-b/.

Exploited behavior:

• Cargo normalizes both registry URLs to an identical canonical form.
• Credentials for victim leak to the attacker-controlled registry, allowing the attacker to capture them.

How to verify:

• Use a proxy or packet capture on the victim machine while Cargo resolves registry dependencies.
• Look for Authorization headers or bearer tokens being sent to the wrong registry endpoint.
• Repeat the test with a fixed Cargo version; the patched version should no longer send credentials across registry paths.

5. Recommendations

Mitigation strategies:

• Upgrade Cargo to a version newer than 1.96 once the fix is available in a released build.
• If you operate a registry hosting service, avoid hosting multiple independent registries under the same domain using arbitrary path-based names.
• Prefer separate hostnames or subdomains for distinct registries to reduce the impact of URL normalization issues.

Detection methods:

• Inspect server logs for auth headers arriving on registry paths that should not receive them.
• Audit clients for registry configurations where multiple sparse registries share a domain.
• Monitor for unexpected access patterns between registry instances on the same host.

Best practices to prevent similar issues:

• Scope credentials to the full canonical registry URL, not just the hostname.
• Treat distinct registry paths as separate trust domains in package manager implementations.
• Keep tooling up to date, especially when using third-party registry features.
• For registry providers, enforce strong namespace isolation and avoid multi-tenant path reuse on the same origin.

Additional note:

• The provided code diff does not contain the fix for this vulnerability, so verification should rely on the actual cargo source changes in the registry URL normalization logic rather than the unrelated test command file.