Researchers hacked GNU Savannah; FSF fixed 26 flaws and published report
Hacktron researchers demonstrated an attack chain on GNU Savannah, the forge hosting the source of Bash and Coreutils: code execution via command injection in the email used by the GPG key test, root through an unpatched kernel, and maintainer powers with push access to bash.git. The flaws were reported to the FSF on May 11, 2026; the FSF treated it as a full compromise, fixed the code, installed a patched kernel, audited access, databases and logs, and published an incident report on June 19, 2026. The researchers say they modified no repositories and no malicious exploitation was reported in the roughly two-month window.
What happened
Security researchers demonstrated they could control GNU Savannah, the platform hosting the source code of Bash, Coreutils and hundreds of GNU projects, and act as a maintainer with write access to the Bash repository. They reported 26 flaws to the FSF in May 2026 and say they changed no code. The FSF fixed the issues, audited systems and published an incident report.
Why it matters
GNU Savannah is a critical link in the software supply chain: according to the researchers, code that lands there is packaged by distributions and installed on millions of machines, and the xz case showed what one compromised link can do. An attacker in this position could push malicious code to Bash or Coreutils under the maintainer's name. The researchers stopped before that and no malicious exploitation was reported.
What to do
The FSF has already fixed the 26 flaws, installed a patched kernel and audited access, databases and logs. Teams running public Savane instances should apply the fixes, and servers on the 5.15 kernel should get Canonical's USN-8255-1.
For the technical team
- Affected
- GNU Project GNU Savannah, plataforma que hospeda o código-fonte de projetos GNU · Savane 3.17-c369 (shipped March 7, 2026) on savannah.gnu.org and savannah.nongnu.org, a window of about two months; Savannah host running Trisquel GNU/Linux 11 with a linux-libre 5.15 kernel built from Ubuntu 22.04's 5.15 LTS. Total of 26 confirmed vulnerabilities: 2 critical, 6 high, 16 medium, 2 low.
- Exploitation
- Exploitation demonstrated by the researchers themselves (Hacktron) and described in a public writeup with payload and steps; no malicious exploitation reported. The FSF treated it as a full compromise and audited access controls, databases and logs.
- Fix
- The FSF fixed the flaws; authorization bugs were fixed through a refactor rather than individual patches. Patched kernel installed on May 14, 2026 (Canonical published USN-8255-1 for the 5.15 kernel on May 7, 2026) and the researchers' account was removed. Incident report published on June 19, 2026.
- Vector
- Command injection in Savane (PHP): the email validator accepts shell metacharacters (backticks, $, {}, /, |) in the local part (frontend/php/include/account.php:275). In the GPG key test (/my/admin/change.php?item=gpgkey), the email is concatenated unescaped into a gpg command executed by proc_open via /bin/sh (frontend/php/include/gpg.php), giving RCE as the web server user to any registered account. Root was obtained with a public exploit for the GameOver(lay) OverlayFS bugs (CVE-2023-2640 and CVE-2023-32629) on the still-unpatched linux-libre 5.15 kernel.
- More details
- Chain: regular account → RCE as web user → database credentials read from configuration → superuser flag on account harshjaiswal → 'Become this user' box to impersonate chet (Chet Ramey, Bash maintainer) → page accepts adding an SSH key with push access to bash.git (confirmed, not executed) → root via OverlayFS → SSH key to a GNU backup host as user gnubackup. Found with the Hacktron tool; the xz backdoor is cited as motivation. Corwin Brust, Savannah administrator, acknowledged the report the same night and agreed to a 30-day disclosure window. Other flaws: authorization bypass in siteadmin/triggercreation.php, session hijacking with session_uid and session_hash in the URL, non-expiring password reset and email change confirmation hashes, stored XSS in the real name field. The FSF warned the operator of the other public Savane instance.
Timeline
A 'How We Could Have Backdoored Bash' writeup on the case draws discussion on r/netsec.
Researcher says the flaws were reported to the FSF in May 2026 and the critical vulnerability was fixed right away.
X thread reports a successful hack of GNU Savannah as security research, with no fix details.
Sources 2 sources
- @S1r1u5_ @S1r1u5_
- @S1r1u5_ @S1r1u5_
- @S1r1u5_ @S1r1u5_
- Securing Internet-Critical Software: How We Could Have Backdoored Bash r/netsec
