Hacktron researchers detail potential Bash backdoor via GNU Savannah

The Hacktron blog documented a method for compromising the GNU Savannah forge. Researchers identified that a specific email address format granted registered users code execution on the backend. By exploiting this vulnerability, they elevated their account to superuser status. This access allowed them to impersonate the maintainer of Bash. The group confirmed they could add an SSH key with push access to the upstream Bash repository, potentially pushing malware into hosted projects.

An unpatched kernel provided root access and access to a GNU backup server. The vulnerability was reported to the Free Software Foundation on May 11, 2026.