THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-4jc5-g844-4x33 (medium) — linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

[GHSA] GHSA-4jc5-g844-4x33 (medium) — linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

medgithub_advisoriesPublished 2026-07-30

GHSA-4jc5-g844-4x33 Severity: medium CVE: CVE-2026-67435

linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

### Summary `lib.url.fetch()` follows HTTP redirects (`follow_redirects=True`). httpx strips only `Authorization` and `Cookie` when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish's `X-Auth-Toke

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-67435cve

Original source: https://github.com/advisories/GHSA-4jc5-g844-4x33