CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh
Mechanize leaks sensitive headers to external origins during meta refreshes if follow_meta_refresh is enabled, allowing attackers to steal tokens or cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107399?
CVE-2026-107399 is a medium-severity vulnerability in sparklemotion mechanize, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.
Which versions are affected by CVE-2026-107399?
2 open source packages ship an affected version, including mechanize.
| Package | Affected | Fixed in |
|---|---|---|
mechanize RubyGems | All versions | 2.14.1 |
mechanize RubyGems | All versions | 2.14.1 |
How do I fix CVE-2026-107399?
Upgrade mechanize to 2.14.1 or later.
Is CVE-2026-107399 being exploited?
There is no known exploitation of CVE-2026-107399 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-107399, GHSA-c6rp-p8xm-4q9f, UBUNTU-CVE-2026-107399.