Read the docs
TI-2026-32437 Aliases CVE-2026-44503GHSA-7j59-v9qr-6fq9

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Priority MEDIUM 64CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00642 51st percentileScored 2026-11-07
Fix Fixed kiota-java (microsoft): 1.9.1Microsoft.Kiota.Abstractions (microsoft): 1.22.0+9 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoftkiota-javabefore 1.9.11.9.1Patch availableCNA
MicrosoftMicrosoft.Kiota.Abstractionsbefore 1.22.01.22.0Patch availableCNA
Microsoftgithub.com/microsoft/kiota-http-gobefore 1.5.51.5.5Patch availableCNA
Microsoftkiota-typescriptbefore 1.0.0-preview.1001.0.0-preview.100Patch availableCNA
Microsoftmicrosoft-kiota-abstractionsbefore 1.9.11.9.1Patch availableCNA
Microsoftmicrosoft-kiota-httpbefore 1.9.91.9.9Patch availableCNA
—com.microsoft.kiota:microsoft-kiota-abstractions (Maven)before 1.9.11.9.1Patch availableGHSA-7j59-v9qr-6fq9
—Microsoft.Kiota.Abstractions (NuGet)before 1.22.01.22.0Patch availableGHSA-7j59-v9qr-6fq9
—microsoft-kiota-http (PyPI)before 1.9.91.9.9Patch availableGHSA-7j59-v9qr-6fq9
—kiota-typescript (npm)before 1.0.0-preview.1001.0.0-preview.100Patch availableGHSA-7j59-v9qr-6fq9
—github.com/microsoft/kiota-http-go (Go)before 1.5.51.5.5Patch availableGHSA-7j59-v9qr-6fq9
  • kiota-java VendorMicrosoft Affected before 1.9.1 Fixed in 1.9.1 Patch available CNA
  • Microsoft.Kiota.Abstractions VendorMicrosoft Affected before 1.22.0 Fixed in 1.22.0 Patch available CNA
  • github.com/microsoft/kiota-http-go VendorMicrosoft Affected before 1.5.5 Fixed in 1.5.5 Patch available CNA
  • kiota-typescript VendorMicrosoft Affected before 1.0.0-preview.100 Fixed in 1.0.0-preview.100 Patch available CNA
  • microsoft-kiota-abstractions VendorMicrosoft Affected before 1.9.1 Fixed in 1.9.1 Patch available CNA
  • microsoft-kiota-http VendorMicrosoft Affected before 1.9.9 Fixed in 1.9.9 Patch available CNA
  • com.microsoft.kiota:microsoft-kiota-abstractions (Maven) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-7j59-v9qr-6fq9
  • Microsoft.Kiota.Abstractions (NuGet) Vendor— Affected before 1.22.0 Fixed in 1.22.0 Patch available GHSA-7j59-v9qr-6fq9
  • microsoft-kiota-http (PyPI) Vendor— Affected before 1.9.9 Fixed in 1.9.9 Patch available GHSA-7j59-v9qr-6fq9
  • kiota-typescript (npm) Vendor— Affected before 1.0.0-preview.100 Fixed in 1.0.0-preview.100 Patch available GHSA-7j59-v9qr-6fq9
  • github.com/microsoft/kiota-http-go (Go) Vendor— Affected before 1.5.5 Fixed in 1.5.5 Patch available GHSA-7j59-v9qr-6fq9

Remediation

  • Fix · CNA kiota-java (microsoft) Fixed in 1.9.1
  • Fix · CNA Microsoft.Kiota.Abstractions (microsoft) Fixed in 1.22.0
  • Fix · CNA github.com/microsoft/kiota-http-go (microsoft) Fixed in 1.5.5
  • Fix · CNA kiota-typescript (microsoft) Fixed in 1.0.0-preview.100
  • Fix · CNA microsoft-kiota-abstractions (microsoft) Fixed in 1.9.1
  • Fix · CNA microsoft-kiota-http (microsoft) Fixed in 1.9.9
  • Fix · GHSA-7j59-v9qr-6fq9 com.microsoft.kiota:microsoft-kiota-abstractions (Maven) Fixed in 1.9.1 Advisory →
  • Fix · GHSA-7j59-v9qr-6fq9 Microsoft.Kiota.Abstractions (NuGet) Fixed in 1.22.0 Advisory →
  • Fix · GHSA-7j59-v9qr-6fq9 microsoft-kiota-http (PyPI) Fixed in 1.9.9 Advisory →
  • Fix · GHSA-7j59-v9qr-6fq9 kiota-typescript (npm) Fixed in 1.0.0-preview.100 Advisory →
  • Fix · GHSA-7j59-v9qr-6fq9 github.com/microsoft/kiota-http-go (Go) Fixed in 1.5.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44503
  2. 2026-10-03 Alias added: GHSA-7j59-v9qr-6fq9
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 4

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences