CVE-2026-44431
published 2026-05-13CVE-2026-44431: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.53%
41.1th percentile
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Affected
131 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-supported-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9-operator | — | — |
| ansible-automation-platform-26 | ee-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9-operator | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9-operator | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-rhel9-operator | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9-operator | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| aquasecurity | trivy | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
vendor_ubuntu8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
urllib3 up to 2.6.x on Python ProxyManager.connection_from_url.urlopen information disclosure
vuldb·2026-05-13·CVSS 8.2
CVE-2026-44431 [HIGH] urllib3 up to 2.6.x on Python ProxyManager.connection_from_url.urlopen information disclosure
A vulnerability marked as problematic has been reported in urllib3 up to 2.6.x on Python. The affected element is the function ProxyManager.connection_from_url.urlopen. Performing a manipulation results in information disclosure.
This vulnerability was named CVE-2026-44431. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
ghsa·2026-05-11
CVE-2026-44431 [HIGH] CWE-200 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
### Impact
When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.
However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.
### Affected usage
Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPCo
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 8.2
CVE-2026-44431 [HIGH] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: Several security issues were fixed in urllib3.
It was discovered that urllib3 incorrectly handled cross-origin redirects
in ProxyManager. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-44431)
It was discovered that urllib3 incorrectly handled decompression of
specially crafted responses. A remote attacker could possibly use this
issue to cause urllib3 to consume resources, leading to a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-44432)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
vendor_redhat·2026-05-13·CVSS 8.2
CVE-2026-44431 [HIGH] CWE-201 urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: external-secrets-operator/bitwarden-sdk-server-rhel9 (External Secrets Operator for Red Hat OpenShift) - Affected
Package: external-secrets-operator/external-secrets-operator-bundle (External Secrets Operator for Red Hat OpenShift) - Affected
Pack
No detection rules found.
No public exploits indexed.
2026-05-13
Published