Git Credential Helper Flaw Opens Door to Cross-Server Password Leaks

The Git project has shipped v2.26.2 to close a security hole in the credential helper mechanism—a direct follow-up to the critical issue patched in v2.26.1 just days earlier. The new advisory covers versions v2.26.1 and older.

The underlying problem is a malformed URL that produces a credential pattern with certain fields left empty. A number of credential helpers treat these blank fields as wildcards, matching any server. In practice, that means a password intended for one host can be handed over to an untrusted destination if an attacker crafts the right URL. The fix in v2.26.2 stops the credential helper from being invoked altogether when the URL contains a value that cannot be properly represented.

Which Helpers Are at Risk?

Not every helper is exposed. Git's own store and cache helpers, along with the osxkeychain helper on macOS, are confirmed vulnerable. Git Credential Manager for Windows is not affected. For any helper not listed, assume it is vulnerable until proven otherwise.

Mitigation and Platform Updates

Upgrading to v2.26.2 is the definitive fix. If an immediate update is not possible, the same interim protections recommended for the previous round apply:

  • Do not run git clone --recurse-submodules on repositories you do not trust.
  • Avoid using credential helpers entirely when cloning public repositories.

GitHub has gone a step further for its own services. Malicious .gitmodules files—including new variants identified in the v2.26.2 disclosure—are now blocked from being pushed to GitHub.com. A GitHub Desktop release is also in preparation that prevents exploitation of this new vulnerability. For enterprise users, the next patch release of GitHub Enterprise Server will backport the same push-blocking protections used on GitHub.com; note that the server installations themselves are not vulnerable to this particular attack.

The vulnerability was discovered by Carlo Arenas, with additional analysis from Jonathan Nieder of Google. Git v2.26.2 is available for download from the official Git website.