Read the docs
TI-2026-39576 Aliases CVE-2026-54770GHSA-6hx8-3wjj-gr8g

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Priority MEDIUM 60CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Partial webob (Pylons): 1.8.11webob (PyPI): 1.8.11Red Hat: 7 advisoriesRed Hat: 7 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pylonswebobbefore 1.8.111.8.11Patch availableCNA
—webob (PyPI)before 1.8.111.8.11Patch availableGHSA-6hx8-3wjj-gr8g
  • webob VendorPylons Affected before 1.8.11 Fixed in 1.8.11 Patch available CNA
  • webob (PyPI) Vendor— Affected before 1.8.11 Fixed in 1.8.11 Patch available GHSA-6hx8-3wjj-gr8g

Remediation

  • Fix · CNA webob (Pylons) Fixed in 1.8.11
  • Fix · GHSA-6hx8-3wjj-gr8g webob (PyPI) Fixed in 1.8.11 Advisory →

Red Hat 7 advisories

  • RHSA-2026:94039 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 security advisory
    • Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16
  • RHSA-2026:81110 Released 2026-10-12 · Red Hat rating Important
    Red Hat Quay 3.18.1
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:79546 Released 2026-10-08 · Red Hat rating Important
    Red Hat Quay 3.12.23
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
Show 4 more Red Hat advisories
  • RHSA-2026:79366 Released 2026-10-08 · Red Hat rating Important
    Red Hat Quay 3.10.27
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:77656 Released 2026-10-07 · Red Hat rating Important
    Red Hat Quay 3.9.27
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2026:94039
Red Hat Quay 3.10Fixed RHSA-2026:79366
Red Hat Quay 3.12Fixed RHSA-2026:79546
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.18Fixed RHSA-2026:81110
Red Hat Quay 3.9Fixed RHSA-2026:77656
Not affected: 10 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 13.0 - ELS
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54770
  2. 2026-10-03 Alias added: GHSA-6hx8-3wjj-gr8g
  3. 2026-10-07 Fix available: RHSA-2026:77656 · Red Hat
  4. 2026-10-08 Fix available: Red Hat Quay 3.9 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:79546 · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:79366 · Red Hat
  7. 2026-10-09 Fix available: Red Hat Quay 3.10, Red Hat Quay 3.12 · Red Hat
  8. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
  9. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
  10. 2026-10-30 Affected versions changed · Red Hat
  11. 2026-11-03 Fix available: RHSA-2026:94039 · Red Hat
  12. 2026-11-03 Fix available: Red Hat OpenStack Platform 13.0 - ELS · Red Hat

References

Advisory 1

Other 4

  • TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
  • TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
  • TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
  • TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2
  • TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in Waitress CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences