CVE-2026-49336 @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
Attackers can steal Bearer tokens and Cookies via cross-origin redirects due to a case-sensitive header scrubbing bug in the default middleware chain.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49336?
CVE-2026-49336 is a medium-severity vulnerability in microsoft kiota-typescript, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Cookie` from cross-origin redirect targets, but the default `scrubSensitiveHeaders` callback in `RedirectHandlerOptions` uses case-sensitive property deletion (`delete headers.Authorization`, `delete headers.Cookie`) on a headers object that `FetchRequestAdapter.getRequestFromRequestInformation` has already lower-cased. The delete therefore targets keys that do not exist, the scrub is a no-op, and any Bearer token or Cookie attached by a kiota-generated SDK is forwarded to an attacker-controlled host across a 30x redirect. This is reachable in the default middleware chain (`MiddlewareFactory.getDefaultMiddlewares`) with no custom configuration, and applies to every kiota-generated TypeScript SDK that uses `BaseBearerTokenAuthenticationProvider` or any other authentication provider that sets the `Authorization` request header. Version 1.0.0-preview.102 patches the issue.
Which versions are affected by CVE-2026-49336?
2 open source packages ship an affected version, including @microsoft/kiota-http-fetchlibrary.
| Package | Affected | Fixed in |
|---|---|---|
@microsoft/kiota-http-fetchlibrary npm | From 1.0.0-preview.97 | 1.0.0-preview.102 |
@microsoft/kiota-http-fetchlibrary npm | From 1.0.0-preview.97 | 1.0.0-preview.102 |
How do I fix CVE-2026-49336?
Upgrade @microsoft/kiota-http-fetchlibrary to 1.0.0-preview.102 or later.
Is CVE-2026-49336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49336 exists.
Sources
Also known as GHSA-396q-4vc8-28x9.