Mechanize leaks credential headers to other hosts after redirects
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Mechanize, a Ruby library for automating website interaction, is affected in versions before 2.14.1 (RubyGems) and before 2.15.0 (sparklemotion). After an HTTP redirect, the library reapplies caller-supplied headers to a different host, and its protected header lists omit Proxy-Authorization and Cookie2, which exposes credentials (CWE-522). A remote attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request headers.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sparklemotion | mechanize | before 2.15.0 | 2.15.0 | Patch available | CNA |
| — | mechanize (RubyGems) | before 2.14.1 | 2.14.1 | Patch available | GHSA-2mwr-xjcg-37j7 |
- mechanize Vendorsparklemotion Affected before 2.15.0 Fixed in 2.15.0 Patch available CNA
- mechanize (RubyGems) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-2mwr-xjcg-37j7
Remediation
Upgrade the RubyGems mechanize package to 2.14.1 and the sparklemotion mechanize package to 2.15.0. Red Hat 3scale API Management Platform 2 is affected, and Red Hat lists no fix planned for it.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA mechanize (sparklemotion) Fixed in 2.15.0
- Fix · GHSA-2mwr-xjcg-37j7 mechanize (RubyGems) Fixed in 2.14.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107715
- 2026-10-09 Alias added: GHSA-2mwr-xjcg-37j7
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-09 CISA SSVC decision points changed
References
Other 7
- https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7
- https://github.com/sparklemotion/mechanize/pull/676
- https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f
- https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745
- https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95
- https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1
- https://github.com/sparklemotion/mechanize
More sparklemotion vulnerabilities
- TI-2022-11724 Improper Handling of Unexpected Data Type in Nokogiri CVSS 3.1HIGH 8.2
- TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
- TI-2025-05895 sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
- TI-2025-05891 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
- TI-2019-03885 OS command injection in Nokogiri CVSS 3.1CRITICAL 9.8
- TI-2026-55247 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer CVSS 4.0HIGH 8.7
Sources
- CVE-2026-107715 · CVE Program
- CVE-2026-107715 · NVD
- FIRST EPSS
- GHSA-2mwr-xjcg-37j7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107715 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences