{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113440", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-26T10:00:02.149Z", "datePublished": "2026-10-26T13:49:17.377Z", "dateUpdated": "2026-10-26T13:49:17.377Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney"], "packageName": "hackney", "packageURL": "pkg:hex/hackney", "product": "hackney", "programFiles": ["src/hackney.erl"], "programRoutines": [{"name": "hackney:request/5"}, {"name": "hackney:follow_redirect/10"}, {"name": "hackney:maybe_strip_auth_on_redirect/3"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "4.9.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney"], "packageName": "benoitc/hackney", "packageURL": "pkg:github/benoitc/hackney", "product": "hackney", "programFiles": ["src/hackney.erl"], "programRoutines": [{"name": "hackney:request/5"}, {"name": "hackney:follow_redirect/10"}, {"name": "hackney:maybe_strip_auth_on_redirect/3"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "6548384b22ea196023a1963e2967d5715b6d9564", "status": "affected", "version": "8f944559bdb83da60b5c06f6cf6d842591278364", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The request is made with <code>follow_redirect</code> enabled and the <code>basic_auth</code> or <code>cookie</code> option set, over HTTP/1.1 or HTTP/2, without <code>location_trusted</code>. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "The request is made with `follow_redirect` enabled and the `basic_auth` or `cookie` option set, over HTTP/1.1 or HTTP/2, without `location_trusted`. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."}], "value": "The request is made with follow_redirect enabled and the basic_auth or cookie option set, over HTTP/1.1 or HTTP/2, without location_trusted. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.9.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Martin Karrer"}, {"lang": "en", "type": "remediation developer", "value": "Martin Karrer"}, {"lang": "en", "type": "remediation developer", "value": "Benoit Chesneau"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-10-26T10:04:03.000Z", "datePublic": "2026-10-25T00:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Insufficiently Protected Credentials vulnerability in <code>hackney</code> in benoitc hackney allows a redirecting server to obtain the <code>basic_auth</code> and <code>cookie</code> credentials of a request via a same-host redirect to another scheme or port. With <code>follow_redirect</code> enabled, <code>hackney:follow_redirect/10</code> in <code>src/hackney.erl</code> reissues the request to the <code>Location</code> target after <code>hackney:maybe_strip_auth_on_redirect/3</code>, which compared only the hostname of the current and the redirect URL. A redirect from <code>https</code> to <code>http</code> on the same host resent the <code>Authorization</code> and <code>Cookie</code> headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. <code>location_trusted</code> forwards credentials to any target by design and is unchanged.</p>\n<p>This issue affects hackney: from 2.0.0 before 4.9.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Insufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_auth` and `cookie` credentials of a request via a same-host redirect to another scheme or port. With `follow_redirect` enabled, `hackney:follow_redirect/10` in `src/hackney.erl` reissues the request to the `Location` target after `hackney:maybe_strip_auth_on_redirect/3`, which compared only the hostname of the current and the redirect URL. A redirect from `https` to `http` on the same host resent the `Authorization` and `Cookie` headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. `location_trusted` forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."}], "value": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."}], "impacts": [{"capecId": "CAPEC-102", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's <code>Authorization</code> and <code>Cookie</code> headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.</p>"}, {"base64": false, "type": "text/markdown", "value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's `Authorization` and `Cookie` headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."}], "value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's Authorization and Cookie headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-26T13:49:17.377Z"}, "references": [{"name": "Strip basic_auth and cookie on redirects that change scheme or port (benoitc/hackney#979)", "tags": ["related"], "url": "https://github.com/benoitc/hackney/pull/979"}, {"name": "EEF CNA record for CVE-2026-113440", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-113440.html"}, {"name": "OSV record EEF-CVE-2026-113440", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"}, {"name": "hackney 4.9.0 release notes", "tags": ["vendor-advisory", "related"], "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"}, {"name": "Introducing commit 8f94455 in benoitc/hackney", "tags": ["related"], "url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"}, {"name": "Fix commit 6548384 in benoitc/hackney", "tags": ["patch"], "url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"}], "source": {"discovery": "EXTERNAL"}, "title": "HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Disable <code>follow_redirect</code> and handle the <code>Location</code> header in the application, or pass the credentials as explicit <code>Authorization</code> and <code>Cookie</code> request headers instead of the <code>basic_auth</code> and <code>cookie</code> options. <code>hackney:follow_redirect/10</code> issues the redirected request with an empty header list, so explicit headers reach the first server only.</p>"}, {"base64": false, "type": "text/markdown", "value": "Disable `follow_redirect` and handle the `Location` header in the application, or pass the credentials as explicit `Authorization` and `Cookie` request headers instead of the `basic_auth` and `cookie` options. `hackney:follow_redirect/10` issues the redirected request with an empty header list, so explicit headers reach the first server only."}], "value": "Disable follow_redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic_auth and cookie options. hackney:follow_redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Redirect handling.</strong> With <code>follow_redirect</code> set, <code>hackney:request/5</code> hands a 3xx response to <code>hackney:follow_redirect/10</code> in <code>src/hackney.erl</code>, which resolves the <code>Location</code> header against the current URL and calls <code>hackney:request/5</code> again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path.</p>\n<p><strong>2. Host-only comparison.</strong> Before the new request, <code>hackney:maybe_strip_auth_on_redirect/3</code> removes the <code>basic_auth</code> and <code>cookie</code> options when the redirect leaves the current host, unless <code>location_trusted</code> is set. It compared <code>#hackney_url.host</code> of the two URLs.</p>\n<p><strong>3. Consequence.</strong> A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same <code>Authorization</code> and <code>Cookie</code> headers. From <code>https</code> to <code>http</code> they travel in cleartext; to another port they reach a different service on the same host.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Redirect handling.** With `follow_redirect` set, `hackney:request/5` hands a 3xx response to `hackney:follow_redirect/10` in `src/hackney.erl`, which resolves the `Location` header against the current URL and calls `hackney:request/5` again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n**2. Host-only comparison.** Before the new request, `hackney:maybe_strip_auth_on_redirect/3` removes the `basic_auth` and `cookie` options when the redirect leaves the current host, unless `location_trusted` is set. It compared `#hackney_url.host` of the two URLs.\n\n**3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same `Authorization` and `Cookie` headers. From `https` to `http` they travel in cleartext; to another port they reach a different service on the same host."}], "value": "1. Redirect handling. With follow_redirect set, hackney:request/5 hands a 3xx response to hackney:follow_redirect/10 in src/hackney.erl, which resolves the Location header against the current URL and calls hackney:request/5 again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n2. Host-only comparison. Before the new request, hackney:maybe_strip_auth_on_redirect/3 removes the basic_auth and cookie options when the redirect leaves the current host, unless location_trusted is set. It compared #hackney_url.host of the two URLs.\n\n3. Consequence. A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same Authorization and Cookie headers. From https to http they travel in cleartext; to another port they reach a different service on the same host."}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney"], "packageName": "hackney", "packageURL": "pkg:hex/hackney", "product": "hackney", "programFiles": ["src/hackney.erl"], "programRoutines": [{"name": "hackney:request/5"}, {"name": "hackney:follow_redirect/10"}, {"name": "hackney:maybe_strip_auth_on_redirect/3"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "4.9.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney"], "packageName": "benoitc/hackney", "packageURL": "pkg:github/benoitc/hackney", "product": "hackney", "programFiles": ["src/hackney.erl"], "programRoutines": [{"name": "hackney:request/5"}, {"name": "hackney:follow_redirect/10"}, {"name": "hackney:maybe_strip_auth_on_redirect/3"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "6548384b22ea196023a1963e2967d5715b6d9564", "status": "affected", "version": "8f944559bdb83da60b5c06f6cf6d842591278364", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."}], "id": "CVE-2026-113440", "lastModified": "2026-10-26T14:16:28.887", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-10-26T14:16:28.887", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-113440.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/benoitc/hackney/pull/979"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{}