GNU Savannah Flaw Could Have Backdoored Bash

Security researchers turned a crafted email address into code execution on GNU Savannah, the Free Software Foundation forge that hosts the source code for Bash and Coreutils, and from there gained the ability to push a change to the upstream Bash repository.

The flaw was a command injection in Savane, the PHP application that runs Savannah. An email address containing shell backticks, accepted at registration, was later fed unsanitised into a shell command when the account owner tested a GPG key, so the server ran whatever the backticks contained.

The team at AI security firm Hacktron found it by pointing its auditing tool at Savannah’s source, and published the write-up on October 30, 2026.

The code that lands on Savannah is packaged by Linux distributions and installed on hundreds of millions of machines. Hacktron reported it to the FSF on May 11, 2026, and the foundation has since patched the forge and fixed a total of 26 confirmed vulnerabilities found in the same audit.

As of October 30, 2026, every reported issue has been fixed. The FSF says it found no reason to believe sensitive project data or credentials were accessed, or that Savannah’s software supply chain was compromised. The researchers say they did not touch any repository.

How an Email Address Ran Commands on the Server

Savannah’s email validator accepts dot-atom addresses that contain characters such as backticks, $ , {} , / and | , because the email standard technically allows them in the local part of an address. That meant a user could register, or change an existing account to use, an address like this one:

The trigger is the account’s “Test GPG keys” button. One of its checks lists key fingerprints for the email on the account, and Savane built that command by appending the raw email address to a gpg --list-keys --fingerprint string, then handed the whole string to PHP’s proc_open() . With a string command, PHP runs it through /bin/sh , so the shell saw the backticks and executed their contents before gpg even started. The ${IFS} stood in for a space, which the validator rejects.

Exploitation took four steps a logged-in user could perform: set the payload as the account email, open the GPG key page, paste any key, and click “Test GPG keys.” The command then ran as the web server user. Hacktron’s first proof simply created an empty file on the server; the researchers then swapped it for a reverse shell and landed on the backend.

From a Web Shell to Bash’s Maintainer

The web server user could read Savannah’s configuration, which holds the database credentials, so nothing had to be cracked. The researchers set the superuser flag on their own account and reloaded the page, which gave them a site-admin “Become this user” box that acts as any account without its password.

They typed in chet . Chet Ramey is the longtime maintainer of Bash, and the account’s authorized-keys page had an empty slot for another SSH key. Savannah’s Git hosting is keyed off those entries, so a key added there grants push access to bash.git as the maintainer. The researchers confirmed the page accepted edits and stopped: in their words, “We did not add a key and we did not touch the repository.”

An attacker in the same position could have pushed a commit to upstream Bash under Ramey’s name, and done the same to Coreutils or any other project hosted on Savannah.

How an Unpatched 2023 Kernel Bug Gave Root

The web shell was unprivileged, but the host made the step easy. Savannah runs Trisquel GNU/Linux 11 on a linux-libre kernel built from Ubuntu 22.04’s 5.15 LTS kernel, which was still exposed to GameOver(lay) — the pair of OverlayFS privilege-escalation bugs tracked as CVE-2023-2640 and CVE-2023-32629 from 2023.

Canonical fixed its 5.19 and 6.2 kernels for those bugs back in 2023, but the 5.15 kernel did not get the fix until USN-8255-1 on May 7, 2026 — four days before Hacktron’s report. The public exploit worked on the first try and returned root on the Savannah backend. As root, the researchers found a key that let them SSH to a GNU backup host as the gnubackup user, at which point they stopped recon and wrote the report.

Could a Backdoor Have Reached Bash Users?

Hacktron likens the find to the 2024 xz Utils backdoor , the compromise that nearly slipped a hidden backdoor into a widely used compression library. The comparison has a limit the researchers are careful to draw: a rogue commit on Savannah would not have reached users automatically.

Bash is distributed as signed release tarballs that Ramey builds and signs himself, so a planted change in the Git repository would still have had to pass him before it shipped to distributions. What the flaw removed was the barrier at the forge — the account controls and SSH keys that decide who can push — not the signing step that follows.

Savannah has been breached before. In 2010, attackers used a SQL injection flaw in Savane to deface the gnu.org page, and the codebase still descends from the 2001 SourceForge code that Savane was forked from.

What the Audit Found and What the FSF Fixed

The command-injection RCE was one finding among many. After the initial report, Hacktron kept its tool running against Savane and produced 33 findings, discarded 7 false positives, and sent the FSF the remaining 26 — two critical, six high, 16 medium and two low — with file paths, line numbers and reproduction steps. The authorization bugs were fixed through a refactor rather than individual patches; one of them was later published as CVE-2026-56355 on June 20, 2026.

Hacktron traced the vulnerable GPG path to the March 7, 2026 release of Savane (3.17-c369), making the exposure window for that specific flaw two months and affecting both savannah.gnu.org and savannah.nongnu.org. The FSF characterised the reported vulnerabilities more broadly as having been present in software published roughly two years earlier, reflecting the age of much of the Savane codebase.

Corwin Brust, a Savannah administrator, acknowledged the report on May 12, 2026 and agreed to a 30-day disclosure window. The FSF installed the fixed kernel and removed the researchers’ account on May 14, 2026, published a statement on June 19, 2026, and released its full incident report and the Savane patches on August 7, 2026.

What Savane Operators Should Do Now

Savannah itself is fixed, so project maintainers hosted there need to take no action over this incident. The exposure now sits with anyone running their own Savane instance: the FSF published the patches with its August 7, 2026 incident report, and operators should apply them and move off the vulnerable 3.17-c369 code path.

The kernel side is a standard patch: any system still on an unfixed Ubuntu 22.04 5.15 kernel should install the USN-8255-1 update that closes GameOver(lay) and reboot. The broader lesson for anyone running a code forge is the one the xz incident already taught — the accounts, SSH keys and build hosts around the repository are part of the attack surface, not just the code inside it.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!