CVE-2026-54584

Executive Summary

CVE-2026-54584 is an unsafe environment variable handling vulnerability in mport, the MidnightBSD Package Manager, affecting versions before 2.7.8. When invoked with elevated privileges (via sudo, setuid, or setgid execution), the utility referenced the TMPDIR environment variable during package metafile extraction, allowing an attacker who controls the process environment to redirect privileged temporary file operations to an attacker-writable directory. The issue is patched in mport 2.7.8 through PR 123, and successful exploitation can lead to privilege escalation or arbitrary file overwrite on affected systems.

Technical Analysis

The vulnerability is classified as CWE-73: External Control of File Name or Path. The root cause lies in mport's failure to sanitize or ignore the TMPDIR environment variable when performing privileged operations. Package managers commonly extract metadata (manifest files, checksums, dependency manifests) into a temporary staging directory before performing validation or installation logic. When the extraction path is derived directly from TMPDIR without privilege-aware validation, an unprivileged local user can influence where the privileged process writes files.

Per the NVD description, mport "used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts." This introduces two distinct risk primitives:

1. Path redirection to attacker-controlled location (CWE-73): The attacker sets TMPDIR to a directory they own or can write to (for example, a path under their home directory or /tmp subdirectory). When mport extracts metafiles during a privileged invocation, the contents are written to the attacker-selected location. Because the write occurs with the privileges of the mport process (potentially root), the attacker gains control over file contents at a path of their choosing.

2. Empty TMPDIR handling: PR 123 explicitly states that the fix also "rejects empty TMPDIR." An empty value previously could resolve to unpredictable behavior (often the current working directory in naive path-joining code), which is another uncontrolled path primitive that the fix eliminates.

The privileged context is the critical precondition. If mport is only ever run as an unprivileged user, TMPDIR manipulation is low-impact — the attacker can already write to their own temp directory. The vulnerability becomes a privilege boundary violation when:

• mport is executed via sudo mport ... where sudo is configured with env_keep for TMPDIR, or the user's environment is otherwise preserved.
• mport is installed setuid or setgid (the NVD description explicitly names setuid/setgid contexts), meaning any local user can trigger the privileged code path.
• A privileged automation script (cron, CI runner, provisioning tool) invokes mport with an inherited environment the attacker can influence.

The patch in version 2.7.8 (PR 123) implements two defenses: ignoring unsafe TMPDIR values when the process runs with elevated privileges, and rejecting empty TMPDIR values outright. This is the standard hardening pattern for privileged temporary file handling — privileged processes should either ignore TMPDIR entirely in favor of a fixed secure location (e.g., a root-owned temp directory) or validate ownership/permissions of any TMPDIR before use.

Notably, the extraction target is metafiles — package metadata, not arbitrary package payloads. This constrains but does not eliminate impact: metadata files may be parsed by downstream tooling, may be trusted implicitly because they reside in a "secure" temp path, or may overwrite files that higher-privilege processes subsequently consume.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-54584. The attack chain below is inferred strictly from the vulnerability class (CWE-73) and the NVD description; no specific function names, file paths, or parameters beyond TMPDIR and "package metafiles" are asserted.

1) Reconnaissance / target identification The attacker first determines whether the target MidnightBSD host has mport installed at a version below 2.7.8, and whether any privileged invocation path exists. Relevant indicators: presence of a setuid/setgid bit on the mport binary, sudoers rules granting mport execution to non-root users, or cron/automation scripts that invoke mport with elevated privileges. Because MidnightBSD is a niche BSD derivative, targeting is typically post-access — the attacker already holds a low-privileged shell and is performing local privilege escalation.

2) Triggering the flaw (environment control) From the low-privileged shell, the attacker exports a malicious TMPDIR value pointing to a directory they own or can write to:

export TMPDIR=/home/attacker/stage

They then invoke the privileged mport path — for example, invoking the setuid binary directly, or leveraging a sudo configuration that preserves TMPDIR (e.g., env_keep) to run a package operation that triggers metafile extraction. Because mport does not validate the privileges of TMPDIR's owner against the current euid, the privileged process accepts the attacker-supplied path.

3) Payload / execution method (vulnerability-class level) When mport extracts package metafiles, the extraction writes those files into /home/attacker/stage (or whichever attacker-controlled path was supplied) with the privileges of the mport process. At the vulnerability-class level, this is an uncontrolled-path file write. The attacker can exploit it in several ways depending on what the extracted metafiles contain and how they are subsequently used:

• Overwrite or pre-seed files that a later privileged process reads from the temp location.
• Exploit a race between extraction and consumption if the temp path is predictable.
• Use the write to a root-owned-expected location to plant content that downstream validation trusts.

The precise exploitation primitive depends on how mport and its callers handle extracted metafiles, which is not detailed in the available data. No specific escalation payload can be asserted without that detail.

4) Post-exploitation impact Because extraction runs under the privileges of the mport process (potentially root in setuid/sudo contexts), successful manipulation of the extraction path can translate into code or file control at elevated privilege. The realistic worst case is local privilege escalation to root on the affected host. The CVSS vector above reflects local attack vector (AV:L), high attack complexity (AC:H — requires a specific privileged invocation path and environment control), low privileges required (PR:L), high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Impact Assessment

The blast radius is limited to systems where mport is invoked in a privileged context — setuid/setgid installations, sudo-authorized invocations, or privileged automation with attacker-influenceable environment. On such hosts, the confidentiality, integrity, and availability impacts are rated High because a successful exploit operates at the privilege level of the mport process, up to and including root. For standard unprivileged desktop or build usage, the practical impact is minimal because the attacker could already write to their own temp directories.

Business-level consequences include:

• Local privilege escalation on non-root shells, potentially leading to full host compromise.
• Persistence via overwritten files in locations that trusted services consume.
• Lateral movement in environments where MidnightBSD hosts run shared services.

MidnightBSD is a low-deployment-share platform, and CVE-2026-54584 has no CISA KEV listing, no EPSS score, no public PoC, and no known exploit-in-the-wild evidence. Immediate prioritization should focus on hosts where mport binaries carry setuid/setgid permissions or where sudo rules allow non-root mport execution.

Detection Guidance

Sigma Rule

title: Possible mport TMPDIR Path Redirection (CVE-2026-54584)
id: 8f3c2a1e-5d47-4b9a-9c21-7e6f0a4b2d10
status: experimental
description: Detects privileged mport invocations with attacker-controlled or empty TMPDIR values,
  consistent with CVE-2026-54584 (CWE-73) exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54584
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  category: process_creation
detection:
  selection_proc:
    Image|endswith:
      - '/mport'
  selection_env:
    - CommandLine|contains|all:
        - 'TMPDIR='
        - 'mport'
    - CommandLine|contains:
        - 'TMPDIR=/tmp/'
        - 'TMPDIR=/home/'
        - 'TMPDIR=/var/tmp/'
        - 'TMPDIR='
  condition: selection_proc and selection_env
falsepositives:
  - Legitimate administrative use of a custom scratch directory
  - Standard build automation that sets TMPDIR under /tmp or /var/tmp
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.54584

YARA Rule

rule CVE_2026_54584_mport_TMPDIR
{
    meta:
        description = "Detects mport binaries referencing TMPDIR near privileged metadata extraction logic (CVE-2026-54584)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54584"
        cve = "CVE-2026-54584"
        severity = "medium"

    strings:
        $mport = "mport" ascii wide
        $tmpdir = "TMPDIR" ascii wide
        $meta1 = "metafile" ascii wide nocase
        $meta2 = "package metadata" ascii wide nocase
        $extract = "extracting" ascii wide nocase

    condition:
        uint16(0) == 0x5a4d or uint32(0) == 0x7f454c46 and
        $mport and $tmpdir and
        (1 of ($meta*) or $extract)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-54584 Possible mport TMPDIR manipulation metadata exfil"; flow:established,to_server; content:"TMPDIR="; http_header; nocase; content:"mport"; nocase; distance:0; within:200; reference:cve,2026-54584; classtype:attempted-user; sid:2026545840; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-54584 mport privileged metadata extraction attempt"; flow:established,to_server; content:"mport"; nocase; content:"extract"; nocase; distance:0; within:100; content:"TMPDIR"; nocase; distance:0; within:200; reference:cve,2026-54584; classtype:attempted-privileges; sid:2026545841; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("mport") and
  process.command_line : ("*TMPDIR=*") and
  (
    process.command_line : ("*TMPDIR=/tmp/*", "*TMPDIR=/home/*", "*TMPDIR=/var/tmp/*")
  )

Splunk SPL Query

index=os sourcetype=auditd OR sourcetype=linux_secure
| eval cmd = coalesce(process.command_line, cmd_line, command)
| search cmd="*mport*" AND cmd="*TMPDIR=*"
| rex field=cmd "TMPDIR=(?<tmpdir_path>[^\s]+)"
| where match(tmpdir_path, "^/tmp/|^/home/|^/var/tmp/|^$")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands by host, user, tmpdir_path
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-54584,mport,privilege_escalation,">
  <rule id="2026545" level="8">
    <decoded_as>json</decoded_as>
    <field name="commandLine">\.*mport\.*</field>
    <field name="commandLine">TMPDIR=</field>
    <description>CVE-2026-54584: Possible mport TMPDIR path redirection attempt with privileged invocation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_54584,privilege_escalation,</group>
  </rule>

  <rule id="2026546" level="12">
    <if_sid>2026545</if_sid>
    <field name="commandLine">mport</field>
    <field name="uid">0</field>
    <description>CVE-2026-54584: Root-invoked mport with controlled TMPDIR — likely exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_54584,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description states the issue is patched in mport 2.7.8 via PR 123, but no tracked source currently provides verified patch metadata; treat this as advisory-only until the vendor supply chain can be validated.

1) Immediate mitigations

• Remove setuid/setgid bits from the mport binary unless operationally required: chmod u-s,g-s $(which mport).
• Audit sudoers for entries permitting non-root mport execution; where present, ensure env_reset is enforced and explicitly remove TMPDIR from env_keep.
• Enforce a fixed, root-owned temp directory for privileged automation calling mport and unset or hardcode TMPDIR in those scripts.
• Restrict local user environment inheritance for cron/CI jobs that invoke mport.
• Monitor for mport invocations with non-standard TMPDIR values (see detection rules above).

2) Patch / upgrade steps

• Upgrade mport to version 2.7.8 or later, which implements PR 123: ignoring unsafe TMPDIR values in privileged contexts and rejecting empty TMPDIR.
• Verify the upgrade via package checksum from the MidnightBSD vendor source before deploying to production.
• Because no patch confidence is established by tracked sources, independently verify the mport 2.7.8 changelog and PR 123 contents against the official MidnightBSD repository prior to rollout.

3) Long-term hardening

• Adopt a policy that privileged package-management tooling must never derive temporary or staging paths from unauthenticated environment variables. Use mkstemp-style secure creation with root-owned parent directories.
• Apply the principle of least privilege: package manager binaries should not carry setuid/setgid bits unless absolutely necessary.
• Integrate CLI environment-variable sanitization checks into code review and CI linting for system utilities.
• Continuously track mport and MidnightBSD advisories; enroll in relevant vendor security feeds.

References

• NVD — CVE-2026-54584: https://nvd.nist.gov/vuln/detail/CVE-2026-54584
• CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• MidnightBSD Project — mport repository and release notes (vendor source for PR 123 and version 2.7.8): https://github.com/MidnightBSD/mport
• CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-54584 at the time of writing. The CVE is not listed in CISA KEV, has no public PoC, no Nuclei template, and no EPSS score from FIRST.org.