Hacktron Reports a GNU Savannah Flaw That Could Have Given Push Access to Bash, and Says the FSF Fixed 26 Vulnerabilities in the Forge

Hacktron's write-up says a shell injection in the Savane forge software behind GNU Savannah, reported to the FSF on May 11, 2026, could have been chained to push access to Bash; the firm says it did not touch the repository.

Verified pipeline

Sources: 2 Publisher: signed Contributor: signed Hash: 35de8c1d75 View

Editor's Note · November 1, 2026

Clarification:

The article says the FSF's incident report could not be reviewed and reports the FSF's side only as Hacktron describes it. The FSF's own report, "Update on GNU Savannah security issue" (static.fsf.org/nosvn/security/savannah-20260807.pdf, read through the Internet Archive), confirms the May 11, 2026 report, the March 7, 2026 savane 3.17-c369 origin of the flaw and the May 14, 2026 kernel fix. It covers findings HCK-001 to HCK-008 only, says two (HCK-005 and HCK-007) were false positives and that some reported issues could not be reproduced or did not apply to its systems, and says the FSF believes "neither sensitive project data nor credentials were accessed, nor that Savannah's software supply chain was compromised." The figure of 26 fixed vulnerabilities and the Bash push-access step are Hacktron's claims; the FSF report does not state them.

Overview

Security firm Hacktron has published an account of a vulnerability chain in GNU Savannah, the forge that hosts Bash, Coreutils and other GNU projects. According to the Hacktron blog post, dated October 30, 2026, a shell injection hidden in an email address gave code execution on the forge’s backend, and the researchers went on to show they could have obtained push access to the upstream Bash repository. LWN.net linked to the post on October 31, 2026.

Every technical detail below comes from Hacktron’s own write-up. The Herald could not retrieve the Free Software Foundation’s incident report that the post links to, so the FSF’s side of events is reported only as Hacktron describes it.

The reported chain

Hacktron says Savannah runs Savane, a PHP application, and that Savane’s email validator accepted addresses containing shell metacharacters such as backticks. A “Test GPG keys” feature then placed the account’s email address into a command string, so the shell ran whatever sat between the backticks as the web server user.

From that foothold, the post says, the researchers read the database credentials from Savane’s configuration, set the superuser flag on their own account, and used the “Become this user” feature to act as another account. The post states that “Chet Ramey maintains Bash” and that they opened his SSH key page, which Savannah’s Git hosting uses to grant push access to bash.git. In the post’s words: “We did not add a key and we did not touch the repository.”

The post adds that the web shell was unprivileged but that the Savannah kernel was still affected by two 2023 OverlayFS bugs (CVE-2023-2640 and CVE-2023-32629), with a fix for the 5.15 kernel line published in USN-8255-1 on May 7, 2026. Using a public exploit, Hacktron says, it obtained root on the Savannah backend and found a key giving SSH access to a GNU backup host.

Disclosure and fixes

Per Hacktron’s disclosure timeline, the team reported the issue on May 11, 2026, and Savannah administrator Corwin Brust acknowledged it on May 12. The FSF installed a fixed kernel and removed the researchers’ account on May 14. The post says the FSF published a statement on June 19, 2026, and an incident report with the Savane patches on August 7, 2026.

Hacktron says it kept auditing Savane afterward and produced 33 findings, discarded 7 as false positives, and sent the FSF the remaining 26: 2 critical, 6 high, 16 medium and 2 low. The post says “The FSF treated it as a full compromise” and that the authorization bugs were fixed through a refactor rather than individual patches. It also says the FSF traced the vulnerable path to the March 7, 2026 release of Savane (3.17-c369), affecting both savannah.gnu.org and savannah.nongnu.org, “so the window was about two months.”

Maintenance context

Hacktron describes the forge as “run by a handful of volunteers and FSF staff with limited resources.” That characterization is the researchers’ own.

What we don’t know

Whether the FSF’s incident report matches Hacktron’s account in every detail; it was not reviewed for this article.
Whether anyone other than Hacktron exploited the flaw during the roughly two-month window; the post does not address this.
Whether other Savannah-hosted projects were checked for unauthorized changes; the post does not say.