This vulnerability involves improper URL normalization in Rust Cargo's handling of third-party registries using the sparse index protocol. Specifically, in version 1.68.0, the use of non-canonical URL paths for authorization decisions can allow an attacker with publishing capabilities on a multi-registry domain to access credentials belonging to other users of that registry. The flaw is categorized under CWE-647 (Use of Non-Canonical URL paths for authorization decisions). The CVSS 4.0 base score is 2.3, indicating low severity. No official remediation or patch has been indicated in the available data.

An attacker able to publish crates in a specially configured third-party registry domain could potentially obtain credentials of other users of the same registry. However, the exploit requires very specific conditions, which limits the likelihood and scope of impact. There are no known exploits in the wild. The vulnerability does not affect confidentiality, integrity, or availability broadly beyond the scoped credential exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published as of the provided information. Users should monitor Rust Cargo advisories for updates and avoid using vulnerable versions in sensitive environments if possible.