Read the docs
TI-2026-40097 Aliases CVE-2026-55553GHSA-hq3h-g68c-hp78

urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

Priority HIGH 72CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed urllib (node-modules): 4.9.1, 2.44.1urllib (npm): 4.9.1, 2.44.1Red Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-modulesurllib3.0.0 to before 4.9.1; before 2.44.14.9.1, 2.44.1Patch availableCNA
—urllib (npm)3.0.0 to before 4.9.14.9.1Patch availableGHSA-hq3h-g68c-hp78
—urllib (npm)before 2.44.12.44.1Patch availableGHSA-hq3h-g68c-hp78
  • urllib Vendornode-modules Affected 3.0.0 to before 4.9.1; before 2.44.1 Fixed in 4.9.1, 2.44.1 Patch available CNA
  • urllib (npm) Vendor— Affected 3.0.0 to before 4.9.1 Fixed in 4.9.1 Patch available GHSA-hq3h-g68c-hp78
  • urllib (npm) Vendor— Affected before 2.44.1 Fixed in 2.44.1 Patch available GHSA-hq3h-g68c-hp78

Remediation

  • Fix · CNA urllib (node-modules) Fixed in 4.9.1, 2.44.1
  • Fix · GHSA-hq3h-g68c-hp78 urllib (npm) Fixed in 4.9.1 Advisory →
  • Fix · GHSA-hq3h-g68c-hp78 urllib (npm) Fixed in 2.44.1 Advisory →

Red Hat 6 advisories

  • RHSA-2026:82151 Released 2026-10-13 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:76788 Released 2026-10-06 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
Show 3 more Red Hat advisories
  • RHSA-2026:72722 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:72712 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:69248 Released 2026-09-21 · Red Hat rating Important
    Red Hat Developer Hub 1.9.9 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:72712
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:72722, RHSA-2026:82151
Red Hat Developer Hub 1.10Fixed RHSA-2026:76788, RHSA-2026:79088
Red Hat Developer Hub 1.9Fixed RHSA-2026:69248
Not affected: 2 products
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55553
  2. 2026-10-03 Alias added: GHSA-hq3h-g68c-hp78
  3. 2026-10-07 EPSS moved to the 50th–90th percentile
  4. 2026-10-07 Fix available: RHSA-2026:76788 · Red Hat
  5. 2026-10-07 Fix available: Red Hat Developer Hub 1.10 · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
  7. 2026-10-09 Affected versions changed · Red Hat
  8. 2026-10-13 Affected versions changed · Red Hat
  9. 2026-10-13 Fix available: RHSA-2026:82151 · Red Hat

References

Other 8

  • TI-2026-29585 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing CVSS 3.1HIGH 8.4
  • TI-2026-20070 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction CVSS 3.1HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences