Is CVE-2022-46176 actively exploited?

No active exploitation of CVE-2022-46176 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-46176 be exploited remotely?

Yes. CVE-2022-46176 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-46176?

CVE-2022-46176 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2022-46176

MEDIUM

CVE-2022-46176

CWE-347Published: January 11, 2023· Updated: Jun 17, 2026

5.9

CVSS v3.1

Official Description

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.

NVD Source

Technical Analysis

CVE-2022-46176 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 5.9.