Hacktron has described a chain of vulnerabilities that, according to the group, could have been used to compromise projects hosted on the GNU Savannah development forge, including Bash.
The group says it used an email address containing shell syntax to obtain code execution on Savannah's backend with any registered user account. Hacktron then elevated its account to superuser privileges and impersonated Bash's maintainer.
As part of the test, the group confirmed that it could add an SSH key with permission to push changes to the upstream Bash repository. This access could have allowed an attacker to insert malicious code into the project.
Hacktron also reports that an unpatched kernel enabled it to obtain root access and reach a GNU backup server. The group says it notified the Free Software Foundation of the findings on May 11, 2026.
Sources: LWN.net.