CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect
Mechanize leaks credentials and cookies to insecure schemes or ports during redirects, exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107714?
CVE-2026-107714 is a medium-severity vulnerability in sparklemotion mechanize, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.
Which versions are affected by CVE-2026-107714?
How do I fix CVE-2026-107714?
Upgrade to a fixed version.
Is CVE-2026-107714 being exploited?
There is no known exploitation of CVE-2026-107714 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-107714, GHSA-5jgv-wc2m-xv99, UBUNTU-CVE-2026-107714.