hackney resends credentials on same-host redirects to another scheme or port
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
CWE-522 (Insufficiently Protected Credentials) in hackney lets a redirecting server obtain the basic_auth and cookie credentials of a request through a same-host redirect to another scheme or port. With follow_redirect enabled, hackney compared only the hostname when deciding whether to strip credentials, so a redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them. A redirect to another port on the same host handed the credentials to a different service. Versions from 2.0.0 before 4.9.0 are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade hackney to 4.9.0, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA hackney (benoitc) Fixed in 4.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
benoitc hackney — hackney 4.9.0 release notes
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-80354 Unbounded response body buffering in hackney allows memory exhaustionPriority MEDIUM 42
- TI-2026-80383 Custom CA pinning bypass in hackney accepts public root certificatesPriority MEDIUM 41
- TI-2026-80384 SSRF allowlist bypass via encoded IPv6 literal in hackneyPriority LOW 29
Timeline
- 2026-10-26 Threatist record created from CVE-2026-113440
- 2026-10-27 Alias added: GHSA-m347-hm9w-wwv9
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
References
More benoitc vulnerabilities
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
- TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
- TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
- TI-2024-06330 HTTP Request Smuggling in benoitc/gunicorn CVSS 3.0HIGH 7.5
Sources
- CVE-2026-113440 · CVE Program
- CVE-2026-113440 · NVD
- FIRST EPSS
- GHSA-m347-hm9w-wwv9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences