CVE-2026-55403 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
Attackers can steal sensitive authentication headers when the tool fetches remote schemas via cross-origin redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55403?
CVE-2026-55403 is a low-severity vulnerability in koxudaxi datamodel-code-generator, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Which versions are affected by CVE-2026-55403?
3 open source packages ship an affected version, including datamodel-code-generator.
| Package | Affected | Fixed in |
|---|---|---|
datamodel-code-generator PyPI | All versions | 0.63.0 |
datamodel-code-generator PyPI | All versions | 0.63.0 |
datamodel-code-generator PyPI | All versions | 0.63.0 |
How do I fix CVE-2026-55403?
Upgrade datamodel-code-generator to 0.63.0 or later.
Is CVE-2026-55403 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55403 exists.
Sources
Also known as GHSA-r5vv-ff45-prp2, MINI-mxch-684f-v5w9, PYSEC-2026-3563.