What’s Vulnerable › Vulnerabilities
CVE-2014-6274: S3 and Glacier remotes creds embedded in the git repo were not encrypted
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-26 · updated 2026-06-17
- Weakness: CWE-311
Description
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919.
Affected products
- git-annex: from 3.20121126 before 5.20140919 — fixed in 5.20140919
How to fix
Upgrade to a fixed version: git-annex 5.20140919. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2014-6274 or the next vulnerability affects your stack