THREAT OPS › Threat News › [GHSA] GHSA-hq3h-g68c-hp78 (high) — urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
[GHSA] GHSA-hq3h-g68c-hp78 (high) — urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
GHSA-hq3h-g68c-hp78 Severity: high CVE: CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
## Summary
urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a **different origin**, urllib preserves the caller-suppli
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-55553cve
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirectionsurl
- http://partner:3001/starturl
- http://attacker:3002/capturedurl
- http://partner:3001`url
- http://attacker:3002`url
- https://api.partner.example/dataurl
- https://attacker.example/capturedurl
Original source: https://github.com/advisories/GHSA-hq3h-g68c-hp78