CVE-2026-107715
published 2026-10-08CVE-2026-107715: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host…
PriorityP341medium6.8CVSS 3.1
AVNACHPRNUINSCCHINAN
EPSS
0.40%
32.1th percentile
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| mechanize_project | mechanize | >= 0 < 2.14.1 | 2.14.1 |
| sparklemotion | mechanize | < 2.15.0 | 2.15.0 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Sparklemotion Mechanize up to 2.14.x HTTP Redirect Agent#request_add_headers redirect (EUVD-2026-95321)
vuldb·2026-10-09·CVSS 6.8
CVE-2026-107715 [MEDIUM] Sparklemotion Mechanize up to 2.14.x HTTP Redirect Agent#request_add_headers redirect (EUVD-2026-95321)
A vulnerability labeled as problematic has been found in Sparklemotion Mechanize up to 2.14.x. Affected by this issue is the function Mechanize::HTTP::Agent#request_add_headers of the component HTTP Redirect Handler. The manipulation results in open redirect.
This vulnerability is cataloged as CVE-2026-107715. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Mechanize sends credential headers to another host after an HTTP redirect
ghsa·2026-10-08
CVE-2026-107715 [MEDIUM] CWE-200 Mechanize sends credential headers to another host after an HTTP redirect
Mechanize sends credential headers to another host after an HTTP redirect
## Summary
`mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credentials set through `Mechanize#request_headers=` leaked even when they were `Authorization`.
## Details
Two defects, both in `lib/mechanize/http/agent.rb`.
**1. `Mechanize#request_headers=` bypassed the redirect strip entirely.** `#request_add_headers` copied `@request_headers` onto every request unconditionally, with no host check, including the request issued after a redirect. The strip in `#response_redirect` mutated only the per-request headers hash and never touched agent state. Because `request_headers=` is the documented way to set a default credential for every request, the header the code
Red Hat
mechanize: mechanize: Information disclosure via cross-domain HTTP redirect
vendor_redhat·2026-10-08·CVSS 6.8
CVE-2026-107715 [MEDIUM] CWE-212 mechanize: mechanize: Information disclosure via cross-domain HTTP redirect
mechanize: mechanize: Information disclosure via cross-domain HTTP redirect
A flaw was found in mechanize. The library fails to strip caller-supplied credential headers when following cross-origin Hypertext Transfer Protocol (HTTP) redirects. A remote attacker who controls the target server of a redirect can exploit this vulnerability to capture sensitive authentication data, such as bearer tokens and session cookies.
Package: 3scale-amp2/system-rhel8 (Red Hat 3scale API Management Platform 2) - Out of support scope
No detection rules found.
No public exploits indexed.
https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4fhttps://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95https://github.com/sparklemotion/mechanize/pull/676https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7
2026-10-08
Published