Rust Cargo versions 1.68.0 to 1.96 contain a vulnerability (CWE-647) related to improper normalization of non-canonical URL paths for authorization decisions in third-party registries using the sparse index protocol. If a hosting provider permits multiple registries with arbitrary names under the same domain, an attacker with publishing rights in one registry could exploit this flaw to access credentials of other users in the same registry. The vulnerability is rated low severity with a CVSS 4.0 score of 2.3, reflecting the niche conditions required for exploitation.

An attacker able to publish crates in a vulnerable registry could obtain credentials of other users within that registry. However, the impact is limited by the very specific environment and conditions needed, including hosting multiple registries with arbitrary names on the same domain and attacker publishing capability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Rust Cargo vendor advisories for updates and consider restricting registry hosting configurations to avoid multiple arbitrary registry names under the same domain if possible.