Researchers Show How a Single Email Address Could Have Led to Control of GNU Savannah and the Bash Repository

Security firm Hacktron has described how it found a serious flaw in Savane, the web application behind GNU Savannah. Savannah hosts the code, maintainer accounts and SSH keys for Bash, Coreutils and hundreds of other GNU projects. The researchers reported that an email address containing special characters passed the site's validation and gave any registered user code execution on the backend.

From there, the team says it made its account a superuser, impersonated Bash's maintainer, and confirmed it could add an SSH key with push access to the upstream Bash repository. An unpatched kernel also gave them root access and access to a GNU backup server. They reported the issue to the Free Software Foundation (FSF) on May 11, 2026, then tested the rest of Savane and reported more problems, for a total of 26 confirmed vulnerabilities. The FSF fixed them and published an incident report.

The stakes are high because code that lands on Savannah is packaged by distributions and installed on millions of machines. Hacktron pointed to the xz backdoor as an example of what one compromised link in that chain can do. It also noted that this infrastructure is run by a small group of volunteers and FSF staff with limited resources.