CVE-2026-55553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55553", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T23:11:20.213Z", "datePublished": "2026-08-25T16:18:21.519Z", "dateUpdated": "2026-08-25T18:25:40.662Z"}, "containers": {"cna": {"title": "urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"}, {"name": "https://github.com/node-modules/urllib/pull/812", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/pull/812"}, {"name": "https://github.com/node-modules/urllib/pull/813", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/pull/813"}, {"name": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16"}, {"name": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46"}, {"name": "https://github.com/node-modules/urllib/releases/tag/v2.44.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/releases/tag/v2.44.1"}, {"name": "https://github.com/node-modules/urllib/releases/tag/v4.9.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/urllib/releases/tag/v4.9.1"}], "affected": [{"vendor": "node-modules", "product": "urllib", "versions": [{"version": ">= 3.0.0, < 4.9.1", "status": "affected"}, {"version": "< 2.44.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T16:18:21.519Z"}, "descriptions": [{"lang": "en", "value": "urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1."}], "source": {"advisory": "GHSA-hq3h-g68c-hp78", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T18:25:35.484065Z", "id": "CVE-2026-55553", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T18:25:40.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55553", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T18:25:35.484065Z"}}}], "references": [{"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T18:25:19.067Z"}}], "cna": {"title": "urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage", "source": {"advisory": "GHSA-hq3h-g68c-hp78", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "node-modules", "product": "urllib", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.9.1"}, {"status": "affected", "version": "< 2.44.1"}]}], "references": [{"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78", "name": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/node-modules/urllib/pull/812", "name": "https://github.com/node-modules/urllib/pull/812", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/urllib/pull/813", "name": "https://github.com/node-modules/urllib/pull/813", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16", "name": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46", "name": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/urllib/releases/tag/v2.44.1", "name": "https://github.com/node-modules/urllib/releases/tag/v2.44.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/urllib/releases/tag/v4.9.1", "name": "https://github.com/node-modules/urllib/releases/tag/v4.9.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T16:18:21.519Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55553", "state": "PUBLISHED", "dateUpdated": "2026-08-25T18:25:40.662Z", "dateReserved": "2026-06-16T23:11:20.213Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-25T16:18:21.519Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "urllib", "vendor": "node-modules", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.9.1"}, {"status": "affected", "version": "< 2.44.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1."}], "id": "CVE-2026-55553", "lastModified": "2026-09-09T21:07:31.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55553", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T18:25:35.484065Z", "version": "2.0.3"}}]}, "published": "2026-08-25T17:17:32.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/pull/812"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/pull/813"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/releases/tag/v2.44.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/releases/tag/v4.9.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-522"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "urllib: urllib: Credential leakage via cross-origin redirects", "id": "2523609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523609"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.", "A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the leakage of credentials to an attacker-controlled server, potentially allowing the attacker to reuse these credentials against the original service."], "name": "CVE-2026-55553", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-08-25T16:18:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55553\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55553\nhttps://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16\nhttps://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46\nhttps://github.com/node-modules/urllib/pull/812\nhttps://github.com/node-modules/urllib/pull/813\nhttps://github.com/node-modules/urllib/releases/tag/v2.44.1\nhttps://github.com/node-modules/urllib/releases/tag/v4.9.1\nhttps://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,4.9.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.44.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "urllib", "source": "cna", "vendor": "node-modules"}, "product": "urllib", "vendor": "node-modules"}], "created": "2026-08-25T17:45:04.920758+00:00", "updated": "2026-08-28T20:36:44.028988+00:00", "vendors": ["node-modules", "node-modules$PRODUCT$urllib"]}