CVE-2026-48595

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48595", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-22T09:36:56.834Z", "datePublished": "2026-06-02T19:08:48.339Z", "dateUpdated": "2026-09-24T20:51:36.899Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "packageName": "tesla", "packageURL": "pkg:hex/tesla", "product": "tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "1.18.3", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "packageName": "elixir-tesla/tesla", "packageURL": "pkg:github/elixir-tesla/tesla", "product": "tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182", "status": "affected", "version": "2d937d5813d7cda5cd726f41824985fb655c920f", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application must include <code>Tesla.Middleware.FollowRedirects</code> in its Tesla middleware pipeline.</p>"}, {"base64": false, "type": "text/markdown", "value": "The application must include `Tesla.Middleware.FollowRedirects` in its Tesla middleware pipeline."}], "value": "The application must include Tesla.Middleware.FollowRedirects in its Tesla middleware pipeline."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.3", "versionStartIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Yordis Prieto"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "datePublic": "2026-06-02T19:08:48.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.</p>\n<p><code>Tesla.Middleware.FollowRedirects</code> strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (<code>@filter_headers [\"authorization\", \"host\"]</code>). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as <code>{\"Authorization\", \"Bearer \u2026\"}</code> (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a <code>Location:</code> response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other <code>Authorization</code> material on the cross-origin request.</p>\n<p>This issue affects tesla: from 1.4.0 before 1.18.3.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\n`Tesla.Middleware.FollowRedirects` strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (`@filter_headers [\"authorization\", \"host\"]`). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as `{\"Authorization\", \"Bearer \u2026\"}` (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a `Location:` response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other `Authorization` material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."}], "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267 Leverage Alternate Encoding"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:51:36.899Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"}, {"name": "EEF CNA record for CVE-2026-48595", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"}, {"name": "OSV record EEF-CVE-2026-48595", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"}, {"name": "Introducing commit 2d937d5 in elixir-tesla/tesla", "tags": ["related"], "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"}, {"name": "Fix commit db963db in elixir-tesla/tesla", "tags": ["patch"], "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"}], "source": {"discovery": "EXTERNAL"}, "title": "Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Normalize all header keys to lowercase before passing them to Tesla. Use <code>\"authorization\"</code> instead of <code>\"Authorization\"</code> when setting headers via <code>Tesla.put_header/3</code> or <code>Tesla.Middleware.Headers</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "Normalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`."}], "value": "Normalize all header keys to lowercase before passing them to Tesla. Use \"authorization\" instead of \"Authorization\" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers."}]}, "adp": [{"references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T15:59:45.683092Z", "id": "CVE-2026-48595", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T15:59:54.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48595", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T15:59:45.683092Z"}}}], "references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T15:59:29.063Z"}}], "cna": {"title": "Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Yordis Prieto"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267 Leverage Alternate Encoding"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "product": "tesla", "versions": [{"status": "affected", "version": "1.4.0", "lessThan": "1.18.3", "versionType": "semver"}], "packageURL": "pkg:hex/tesla", "packageName": "tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}]}, {"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "product": "tesla", "versions": [{"status": "affected", "version": "2d937d5813d7cda5cd726f41824985fb655c920f", "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182", "versionType": "git"}], "packageURL": "pkg:github/elixir-tesla/tesla", "packageName": "elixir-tesla/tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}]}], "datePublic": "2026-06-02T19:08:48.000Z", "references": [{"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48595.html", "name": "EEF CNA record for CVE-2026-48595", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595", "name": "OSV record EEF-CVE-2026-48595", "tags": ["related"]}, {"url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f", "name": "Introducing commit 2d937d5 in elixir-tesla/tesla", "tags": ["related"]}, {"url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182", "name": "Fix commit db963db in elixir-tesla/tesla", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Normalize all header keys to lowercase before passing them to Tesla. Use \"authorization\" instead of \"Authorization\" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers.", "supportingMedia": [{"type": "text/html", "value": "<p>Normalize all header keys to lowercase before passing them to Tesla. Use <code>\"authorization\"</code> instead of <code>\"Authorization\"</code> when setting headers via <code>Tesla.put_header/3</code> or <code>Tesla.Middleware.Headers</code>.</p>", "base64": false}, {"type": "text/markdown", "value": "Normalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.</p>\n<p><code>Tesla.Middleware.FollowRedirects</code> strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (<code>@filter_headers [\"authorization\", \"host\"]</code>). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as <code>{\"Authorization\", \"Bearer \u2026\"}</code> (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a <code>Location:</code> response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other <code>Authorization</code> material on the cross-origin request.</p>\n<p>This issue affects tesla: from 1.4.0 before 1.18.3.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\n`Tesla.Middleware.FollowRedirects` strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (`@filter_headers [\"authorization\", \"host\"]`). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as `{\"Authorization\", \"Bearer \u2026\"}` (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a `Location:` response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other `Authorization` material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity"}]}], "configurations": [{"lang": "en", "value": "The application must include Tesla.Middleware.FollowRedirects in its Tesla middleware pipeline.", "supportingMedia": [{"type": "text/html", "value": "<p>The application must include <code>Tesla.Middleware.FollowRedirects</code> in its Tesla middleware pipeline.</p>", "base64": false}, {"type": "text/markdown", "value": "The application must include `Tesla.Middleware.FollowRedirects` in its Tesla middleware pipeline.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.3", "versionStartIncluding": "1.4.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:51:36.899Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48595", "state": "PUBLISHED", "dateUpdated": "2026-09-24T20:51:36.899Z", "dateReserved": "2026-05-22T09:36:56.834Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-02T19:08:48.339Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "packageName": "tesla", "packageURL": "pkg:hex/tesla", "product": "tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "1.18.3", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Tesla.Middleware.FollowRedirects'"], "packageName": "elixir-tesla/tesla", "packageURL": "pkg:github/elixir-tesla/tesla", "product": "tesla", "programFiles": ["lib/tesla/middleware/follow_redirects.ex"], "programRoutines": [{"name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"}], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "versions": [{"lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182", "status": "affected", "version": "2d937d5813d7cda5cd726f41824985fb655c920f", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A796038-A843-4B88-83C9-22493F7482B0", "versionEndExcluding": "1.18.3", "versionStartIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."}, {"lang": "es", "value": "Vulnerabilidad de manejo inadecuado de la distinci\u00f3n entre may\u00fasculas y min\u00fasculas en elixir-tesla tesla permite la fuga de credenciales a un origen de terceros en redirecciones de origen cruzado.\n\nTesla.Middleware.FollowRedirects elimina encabezados sensibles a la seguridad en redirecciones de origen cruzado utilizando una comparaci\u00f3n de cadenas que distingue entre may\u00fasculas y min\u00fasculas contra una lista de filtros en min\u00fasculas (@filter_headers ['authorization', 'host']). Los nombres de los encabezados HTTP no distinguen entre may\u00fasculas y min\u00fasculas seg\u00fan la RFC 7230, pero Tesla conserva las claves de los encabezados textualmente tal como las proporciona el llamador sin normalizar las may\u00fasculas y min\u00fasculas. Un encabezado establecido como {'Authorization', 'Bearer ...'} (la capitalizaci\u00f3n can\u00f3nica de la RFC 7235 utilizada por pr\u00e1cticamente todas las bibliotecas y documentaci\u00f3n HTTP) no coincide con la entrada del filtro en min\u00fasculas y se reenv\u00eda al destino de la redirecci\u00f3n. Un atacante que puede controlar o influir en una respuesta Location: vista por el cliente (a trav\u00e9s de su propio punto final, un upstream de redirecci\u00f3n abierta o un origen comprometido) recibe el token de portador u otro material de autorizaci\u00f3n en la solicitud de origen cruzado.\n\nEste problema afecta a tesla: desde 1.4.0 antes de 1.18.3."}], "id": "CVE-2026-48595", "lastModified": "2026-09-24T21:17:13.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48595", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T15:59:45.683092Z", "version": "2.0.3"}}]}, "published": "2026-06-02T20:16:38.390", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,1.18.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tesla", "source": "cna", "vendor": "elixir-tesla"}, "product": "tesla", "vendor": "elixir-tesla"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2d937d5813d7cda5cd726f41824985fb655c920f,db963dba67651b9abd1fc420a1d9679cf6efe182)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tesla", "source": "cna", "vendor": "elixir-tesla"}, "product": "tesla", "vendor": "elixir-tesla"}], "created": "2026-06-03T04:30:05.943860+00:00", "updated": "2026-06-03T10:54:58.413388+00:00", "vendors": ["elixir-tesla", "elixir-tesla$PRODUCT$tesla"]}