High CVSS 7.7
CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read sensitive data. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- The authentication mechanism can be bypassed, letting an attacker pose as a legitimate user.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.