CVE-2026-7017 HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets
HTTP::Tiny leaks sensitive credentials to cross-origin redirect targets, allowing attackers to steal authentication tokens and cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-7017?
CVE-2026-7017 is a high-severity vulnerability in HAARG HTTP::Tiny, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.
The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.
Weakness: CWE-522
Which versions are affected by CVE-2026-7017?
Linux distribution packages (2)
perl-HTTP-Tiny openSUSE:Leap 16.0 | All versions | 0.096-bp160.1.1 |
perl-HTTP-Tiny openSUSE:Tumbleweed | All versions | 0.096-2.1 |
How do I fix CVE-2026-7017?
Upgrade to a fixed version.
Is CVE-2026-7017 being exploited?
There is no known exploitation of CVE-2026-7017 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-7017, ECHO-2e89-77f4-18bd, GHSA-pgc4-5jjm-7rr7, OESA-2026-3169, ROOT-OS-DEBIAN-11-CVE-2026-7017, UBUNTU-CVE-2026-7017 and 2 more.