# CVE-2026-54581: MidnightBSD mport hash verification bypass in bootstrap index fetch

Source: https://junglewise.ai/threats/cve-2026-54581-midnightbsd-mport-hash-verification-bypass-in-bootstrap-index  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54581 · Severity: info · CVSS 6.5 · Published 2026-09-17

mport is the package manager for MidnightBSD operating systems, responsible for installing and managing software packages. A flaw in the bootstrap process could allow an attacker controlling a package mirror or intercepting network traffic to serve a tampered package index that mport incorrectly treats as valid, potentially leading to installation of malicious packages during system initialization.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54581 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54581 being exploited in the wild.

**How severe is CVE-2026-54581?** Informational severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54581?** A patch was published on 2026-09-17: Version 2.7.8 includes the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54581 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54581?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a hash verification bypass in the mport_fetch_bootstrap_index() function in libmport/fetch.c. When bootstrap index hash verification fails (due to a missing or invalid hash), the failure path incorrectly returns success instead of propagating the fatal error to the caller. The root cause is that on hash verification failure, the function calls mport_call_msg_cb() to log the error but does not set result = MPORT_ERR_FATAL before returning, leaving result in its previous MPORT_OK state from the successful file fetch. A network attacker or compromised mirror can exploit this by serving an altered bootstrap index, which mport will proceed to use without detecting tampering. The fix, deployed in version 2.7.8, ensures the fatal error status is properly set and propagated when hash verification fails.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Version 2.7.8 includes the fix

## References

- [https://github.com/MidnightBSD/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e](https://github.com/MidnightBSD/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e)
- [https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d](https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)