Mechanize leaks configured headers to other origins on meta refresh
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Mechanize before 2.14.1 applies no origin trust boundary to meta refresh redirects when follow_meta_refresh is enabled. A page with a meta refresh to another origin causes headers set through request_headers= to be sent to that origin (CWE-522). A remote attacker who controls content in a crawl can capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sparklemotion | mechanize | before 2.15.0 | 2.15.0 | Patch available | CNA |
| — | mechanize (RubyGems) | before 2.14.1 | 2.14.1 | Patch available | GHSA-c6rp-p8xm-4q9f |
- mechanize Vendorsparklemotion Affected before 2.15.0 Fixed in 2.15.0 Patch available CNA
- mechanize (RubyGems) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-c6rp-p8xm-4q9f
Remediation
Upgrade the RubyGems package mechanize to version 2.14.1, which fixes the issue. The sources list no fixed version for sparklemotion mechanize, which lists versions before 2.15.0 as affected. Red Hat rates this Moderate and plans no fix for Red Hat 3scale API Management Platform 2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA mechanize (sparklemotion) Fixed in 2.15.0
- Fix · GHSA-c6rp-p8xm-4q9f mechanize (RubyGems) Fixed in 2.14.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107399
- 2026-10-09 Alias added: GHSA-c6rp-p8xm-4q9f
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
References
Other 6
- https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f
- https://github.com/sparklemotion/mechanize/pull/676
- https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f
- https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3
- https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1
- https://github.com/sparklemotion/mechanize
More sparklemotion vulnerabilities
- TI-2022-11724 Improper Handling of Unexpected Data Type in Nokogiri CVSS 3.1HIGH 8.2
- TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
- TI-2026-69678 Mechanize leaks credential headers to other hosts after redirects CVSS 3.1MEDIUM 6.8
- TI-2025-05895 sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
- TI-2025-05891 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow CVSS 4.0MEDIUM 4.8
- TI-2019-03885 OS command injection in Nokogiri CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-107399 · CVE Program
- CVE-2026-107399 · NVD
- FIRST EPSS
- GHSA-c6rp-p8xm-4q9f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107399 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences