Git for Windows NTLM Hash Leak Poses Credential Risk

A notable vulnerability, tracked as CVE-2026-32631, has been identified in Git for Windows. According to the National Vulnerability Database, versions prior to 2.53.0.windows.3 lack critical protections against NTLM hash exposure. This isn’t just a theoretical flaw; an attacker can exploit this by enticing users to clone a malicious repository or check out a compromised branch. The kicker? NTLM authentication typically requires no user interaction, making this a stealthy attack vector.

The National Vulnerability Database highlights that once an NTLM hash is obtained, it opens the door to offline brute-forcing. While NTLMv2 hashes are computationally expensive to crack, it’s far from impossible for a determined adversary. Successful cracking means credentials are laid bare, potentially leading to broader network compromise. This vulnerability, rated 7.4 (High Severity) on the CVSS scale, underscores the persistent risk associated with NTLM and the need for robust controls around development tools.