CVE-2026-57894

The CVSS 8.5 rating assigned to this Git redirect validation flaw warrants scrutiny before you allocate remediation resources. The EPSS score of 0.00267 (roughly 0.27% probability of exploitation in the next 30 days) isn't lagging — it reflects a genuine gap between worst-case content severity and realistic exploitability. For repository exfiltration to succeed through this vector, an attacker must either compromise an allowlisted Git server, register a domain that a legitimate migration target redirects through, or find an open redirect on an approved endpoint. These aren't impossible conditions, but they require a multi-step chain that rarely co-occurs in practice. The vulnerability mechanism — validation occurring before redirect resolution — is a legitimate architectural flaw, but the severity rating conflates what could be stolen with how likely theft is to occur. The more probable exploitation scenario isn't initial access but lateral movement: an attacker who has already gained foothold through phishing or credential compromise uses this as a high-value exfiltration mechanism. Repositories contain credentials, internal APIs, and proprietary logic — not merely content but the architectural foundation of your systems. This means the finding warrants attention as a post-compromise risk, not an initial intrusion vector. The architectural question matters enormously: was redirect following ever a documented feature, or did it emerge as implicit behavior from an HTTP client that followed redirects by default? If the latter, this represents a security model built on an accidental implementation detail that was never threat-modeled. The fix — whether it validates final destinations or disables redirects entirely — needs to be understood in context: the latter isn't restoring a security boundary, it's inventing one, with different failure modes. For defenders: prioritize based on your threat model. If you face sophisticated adversaries capable of lateral movement, this merits attention as a secondary boundary. If your primary concern is opportunistic external exploitation, the EPSS data suggests other findings warrant earlier attention. Either way, examine whether similar redirect-following patterns exist in your migration, webhook, or external-integration features — the same implicit assumption likely repeats elsewhere.

Reviewed through automated stages and approved by a human before publication.