Bug 2568813 (CVE-2026-123532)

Summary: CVE-2026-123532 gix-fs: gix-fs: Information disclosure via crafted UNC symbolic link paths
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in gix-fs. This vulnerability allows a remote attacker to cause information disclosure by convincing a user on Windows to check out a specially crafted repository with symbolic links enabled. When the application creates symbolic links pointing to remote Universal Naming Convention (UNC) paths, it initiates an automatic Server Message Block (SMB) connection to the target server. This connection can leak the victim's Windows authentication credentials, including their username, domain, and cryptographic password hashes, to an attacker-controlled system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-08 02:06:17 UTC 
gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.