# CVE-2026-54586: MidnightBSD mport HTTP package fetch without HTTPS enforcement

Source: https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54586 · Severity: info · CVSS 6.5 · Published 2026-09-17

mport is the package manager for MidnightBSD, responsible for downloading and installing software packages. Prior to version 2.7.8, the package manager accepted non-HTTPS URLs for repository and package mirror downloads, allowing a network attacker to intercept and modify package files or repository indices, potentially delivering malicious software to users.

Technologies: [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport). Vendors: [MidnightBSD](https://junglewise.ai/threats/vendors/midnightbsd).

## Quick answers

**Is CVE-2026-54586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54586 being exploited in the wild.

**How severe is CVE-2026-54586?** Informational severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** MidnightBSD Mport before 2.7.8.

**Is there a fix for CVE-2026-54586?** A patch was published on 2026-05-14: Fixed in version 2.7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54586 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54586?** Check whether you run MidnightBSD Mport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in libmport/fetch.c where the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() functions failed to enforce HTTPS when fetching package indices and bundles from repositories or mirrors. An attacker positioned on the network path (e.g., via ARP spoofing, DNS hijacking, or BGP hijacking) can intercept cleartext HTTP traffic and inject malicious package data or forge repository index entries. The fix (version 2.7.8) adds a url_is_https() enforcement check to require all fetches use HTTPS, preventing plaintext transport-layer tampering. No authentication bypass or file write vulnerability is present; the issue is purely about transport security.

## Affected products

- MidnightBSD mport before 2.7.8

## Timeline

- 2026-09-17: disclosed
- 2026-05-14: patched: Fixed in version 2.7.8

## References

- [https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921](https://github.com/MidnightBSD/mport/commit/9b4d0f9192b243ee32266afa36dce430b257b921)
- [https://github.com/MidnightBSD/mport/pull/121](https://github.com/MidnightBSD/mport/pull/121)

## Related threats

- [mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used)
- [MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation)
- [MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling)
- [MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling)
- [MidnightBSD mport file conflict check bypass](https://junglewise.ai/threats/cve-2026-54582-midnightbsd-mport-file-conflict-check-bypass)