CVE-2026-62960

CVE-2026-62960 is a credential exposure vulnerability in Git for Windows where the bundle-URI feature can be weaponized to leak NTLM hashes via SMB. The root cause is not a code defect but an architectural mismatch: the bundle-URI protocol lets a legitimate Git server redirect clients to arbitrary URIs, and the client treats non-HTTP(S) schemes as local filesystem paths. On Windows, bare paths and file:// URIs can resolve to UNC shares, triggering SMB with automatic credential negotiation. The victim never reaches out to an attacker—the trusted Git server redirects them into exposing their credentials. This is the same class of vulnerability that produced CVE-2019-1349, CVE-2018-17456, and numerous similar NTLM exposure bugs in Windows-ported software. The pattern is invariant: Unix developers treat file:// and local paths as semantically identical, Windows resolves them through SMB with credential negotiation, and years later someone finds the leak. The upstream Git project has not consistently treated this as a recurring class of bug—each instance gets patched in isolation while the underlying protocol assumption survives. The CVSS 7.4 rating significantly understates real-world risk. Once a server advertises a malicious bundle URI, every connected client is weaponized simultaneously without requiring individual phishing or endpoint compromise. Organizations running transfer.bundleuri=true almost certainly do so in CI/CD pipelines—automated, unattended systems often operating with service accounts that have broader domain permissions. The human friction that normally slows attacks (user interaction, hesitation) doesn't exist. One compromised Git server becomes a high-frequency, automated credential harvesting system operating outside monitoring that flags human login anomalies. Check whether transfer.bundleuri is enabled in your environment—it's non-default but common in enterprise CI/CD. If possible, disable it or restrict bundle URI handling to explicit HTTP(S) sources. Monitor for outbound SMB connections originating from Git processes, particularly to unfamiliar hosts. The fix in 2.55.0.windows.4 presumably restricts bundle URIs to safe schemes, but verify whether upstream Git adopted compatible changes. If not, you have a Windows-specific patch on a protocol design flaw that remains intact in the upstream specification—a divergence that could confuse auditors and leave the vulnerability recreatable via other paths.

Reviewed through automated stages and approved by a human before publication.