CVE-2026-48595
published 2026-06-02CVE-2026-48595: Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects…
PriorityP346high8.2CVSS 4.0
AVNACLATPPRNUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.40%
31.8th percentile
Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.
Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.
This issue affects tesla: from 1.4.0 before 1.18.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elixir-tesla | tesla | >= 1.4.0 < 1.18.3 | 1.18.3 |
| elixir-tesla | tesla | >= 2d937d5813d7cda5cd726f41824985fb655c920f < db963dba67651b9abd1fc420a1d9679cf6efe182 | db963dba67651b9abd1fc420a1d9679cf6efe182 |
| nvidia | tesla | >= 0.6.0 < 1.18.3 | 1.18.3 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cisa8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
ghsa·2026-07-10
CVE-2026-48595 [HIGH] CWE-178 Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
### Summary
`Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string `"authorization"`. Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing (`"Authorization"`) bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at.
### Details
The filter list in `lib/tesla/middleware/follow_redirects.ex` is defined as `@filter_headers ["authorization", "host"]` and the membership check `k not in @filter_headers` compares
VulDB
elixir-tesla up to 1.18.2 Their Own Endpoint filter_headers case sensitivity (GHSA-9m9w-gxf7-rh8m)
vuldb·2026-06-03·CVSS 8.2
CVE-2026-48595 [HIGH] elixir-tesla up to 1.18.2 Their Own Endpoint filter_headers case sensitivity (GHSA-9m9w-gxf7-rh8m)
A vulnerability was found in elixir-tesla tesla up to 1.18.2. It has been rated as problematic. The impacted element is an unknown function of the component Their Own Endpoint. Performing a manipulation of the argument filter_headers results in improper handling of case sensitivity.
This vulnerability is reported as CVE-2026-48595. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
CISA
Android Framework Integer Overflow Vulnerability
cisa·2026-06-02·CVSS 8.4
CVE-2025-48595 [HIGH] CWE-190 Android Framework Integer Overflow Vulnerability
Vulnerability: Android Framework Integer Overflow Vulnerability
Affected: Android Framework
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://source.android.com/docs/security/bulletin/2026/2026-06-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48595
Remediation Due Date: 2026-06-05
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-48595.htmlhttps://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8mhttps://osv.dev/vulnerability/EEF-CVE-2026-48595https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m
2026-06-02
Published