Read the docs
TI-2024-19051 Aliases CVE-2024-28849GHSA-cxjh-pqwp-8mfp

Proxy-Authorization header kept across hosts in follow-redirects

Priority MEDIUM 62CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 17 fixed, 21 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01044 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial follow-redirects (follow-redirects): 1.15.6follow-redirects (npm): 1.15.6Red Hat: 13 advisoriesRed Hat: 17 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
follow-redirectsfollow-redirectsbefore 1.15.61.15.6Patch availableCNA
—follow-redirects (npm)before 1.15.61.15.6Patch availableGHSA-cxjh-pqwp-8mfp
  • follow-redirects Vendorfollow-redirects Affected before 1.15.6 Fixed in 1.15.6 Patch available CNA
  • follow-redirects (npm) Vendor— Affected before 1.15.6 Fixed in 1.15.6 Patch available GHSA-cxjh-pqwp-8mfp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:*before 1.15.6VulnerableFollow-redirects Project
  • cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:* Versions before 1.15.6 Vulnerable ·Follow-redirects Project

Remediation

  • Fix · CNA follow-redirects (follow-redirects) Fixed in 1.15.6
  • Fix · GHSA-cxjh-pqwp-8mfp follow-redirects (npm) Fixed in 1.15.6 Advisory →

Red Hat 13 advisories

  • RHSA-2025:1609 Released 2025-02-17 · Red Hat rating Important
    Cluster Observability Operator 1.0.0
    • Cluster Observability Operator 1.0.0 registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator
  • RHSA-2024:8677 Released 2024-10-30 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.12.6 security update
    • Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2024:7164 Released 2024-09-26 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
    • 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
Show 10 more Red Hat advisories
  • RHSA-2024:4836 Released 2024-07-24 · Red Hat rating Moderate
    RHACS 4.5 enhancement and security update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:0041 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:3989 Released 2024-06-20 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
  • RHSA-2024:3868 Released 2024-06-17 · Red Hat rating Important
    Network Observability 1.6.0 for OpenShift
    • NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
  • RHSA-2024:3920 Released 2024-06-13 · Red Hat rating Important
    Migration Toolkit for Runtimes security, bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2024:3781 Released 2024-06-10 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
  • RHSA-2024:3550 Released 2024-06-03 · Red Hat rating Important
    HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO 4.0.0 for Red Hat build of Apache Camel 4
  • RHSA-2024:3316 Released 2024-05-23 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
  • RHSA-2024:1946 Released 2024-04-22 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.5.1 security update
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +7
  • RHSA-2024:1474 Released 2024-03-27 · Red Hat rating Moderate
    logging for Red Hat OpenShift security update
    • RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 2AffectedNo fix yet: Fix deferred
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for Applications 6AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
8Base-RHMTC-1.8Fixed RHSA-2024:7164
Cluster Observability Operator 1.0.0Fixed RHSA-2025:1609
HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed RHSA-2024:3550
MTA 6.2 for RHEL 8Fixed RHSA-2024:3989
MTA 7.0 for RHEL 9Fixed RHSA-2024:3316
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2024:3920
NETOBSERV 1.6 for RHEL 9Fixed RHSA-2024:3868
OpenShift Pipelines version 1.15 for RHEL 8Fixed—
RHACS 4.5 for RHEL 8Fixed RHSA-2024:4836
RHOL 5.8 for RHEL 9Fixed RHSA-2024:1474
RHOSSM 2.5 for RHEL 8Fixed RHSA-2024:1946
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9Fixed—
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:3781
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:3781
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0041
Red Hat OpenShift GitOps 1.12Fixed RHSA-2024:8677
multicluster engine for Kubernetes 2.5 for RHEL 9Fixed—
Not affected: 23 products
  • 8Base-RHMTC-1.8
  • Cluster Observability Operator 1.0.0
  • MTA 6.2 for RHEL 8
  • MTA 7.0 for RHEL 8
  • MTA 7.0 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Data Grid 8
  • Red Hat Discovery 1
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat Openshift Data Foundation 4
  • Red Hat Satellite 6
  • Red Hat build of OptaPlanner 8
  • multicluster engine for Kubernetes 2.5 for RHEL 8
  • multicluster engine for Kubernetes 2.5 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28849
  2. 2026-10-03 Alias added: GHSA-cxjh-pqwp-8mfp
  3. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 3

Other 4

  • TI-2026-76983 Credential headers leak across redirects in follow-redirects CVSS 4.0HIGH 8.2
  • TI-2026-76533 Regex escaping flaw in follow-redirects leaks credential headers CVSS 4.0HIGH 8.2
  • TI-2023-11383 Improper input validation in follow-redirects CVSS 3.1HIGH 7.3
  • TI-2026-81522 Credential headers forwarded on redirects in follow-redirects CVSS 3.1MEDIUM 5.9
  • TI-2022-00097 Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2026-29551 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences