Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. hubuum_client
  4. ›
  5. GHSA-qqc3-94qv-7fw3

GHSA-qqc3-94qv-7fw3: Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

July 24, 2026

When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams.

References

  • github.com/advisories/GHSA-qqc3-94qv-7fw3
  • github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50
  • github.com/hubuum/hubuum-client-rust/releases/tag/v0.6.1
  • github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-qqc3-94qv-7fw3

Code Behaviors & Features

Detect and mitigate GHSA-qqc3-94qv-7fw3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.3.0 before 0.6.1

Fixed versions

  • 0.6.1

Solution

Upgrade to version 0.6.1 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-693: Protection Mechanism Failure

Source file

cargo/hubuum_client/GHSA-qqc3-94qv-7fw3.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:19:05 +0000.