# CVE-2026-54577: MidnightBSD mport argument handling flaw in audit command

Source: https://junglewise.ai/threats/cve-2026-54577-midnightbsd-mport-argument-handling-flaw-in-audit-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54577 · Severity: info · Published 2026-09-17

mport is the package manager for MidnightBSD systems. A flaw in the audit command could cause it to check the wrong target when options are used, resulting in vulnerable packages being incorrectly reported as safe. This could allow administrators to unknowingly deploy systems with unpatched security issues.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54577 being exploited in the wild.

**How severe is CVE-2026-54577?** Informational severity, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport prior to 2.7.8.

**Is there a fix for CVE-2026-54577?** A patch was published on 2026-05-31: Version 2.7.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54577 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-54577?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command-line argument parsing bug in mport/mport.c's audit command. When users supplied options like -r before a package name, the function computed adjusted argument values (local_argv, local_argc) but failed to reset optind and optreset state before passing arguments to audit_package(). This caused the function to audit the option token itself rather than the requested package, producing false-negative audit results. The fix (version 2.7.8) properly resets optind and optreset before processing adjusted arguments. No special privileges or network access are required; the bug manifests during normal operator or automated package auditing workflows.

## Affected products

- MidnightBSD mport prior to 2.7.8

## Timeline

- 2026-05-31: disclosed: Fix merged upstream
- 2026-05-31: patched: Version 2.7.8 released

## References

- [https://github.com/MidnightBSD/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0](https://github.com/MidnightBSD/mport/commit/b897240dc8181c53fbee231e77f88657c1edb9a0)
- [https://github.com/MidnightBSD/mport/pull/149](https://github.com/MidnightBSD/mport/pull/149)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)