IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.9Media

CVE-2026-40895follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

follow-redirects follow-redirects; Red Hat Cryostat 4 on RHEL 9; Red Hat Cluster Observability Operator 1.5.0; Red Hat multicluster engine for Kubernetes 2.1 Publicada: (hace 6 meses)

Descripción

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Debilidad (CWE): CWE-200CWE-212

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
acm 2.14 —
acm 2.15 —
acm 2.16 —
advanced cluster security 4.10 —
advanced cluster security 4.9 —
ansible automation platform 2.5 —
cluster observability operator 1.5 —
cryostat 4 —
discovery 2 —
follow-redirects follow-redirects < 1.16.0
migration toolkit applications 8.1 —
multicluster engine 2.10 —
multicluster engine 2.11 —
multicluster engine 2.6 —
multicluster engine 2.8 —
multicluster engine 2.9 —
network observ optr 1.11 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift 4.22 —
openshift ai 2.25 —
openshift ai 3.3 —
openshift devspaces 3.28 —
quay 3.10 —
quay 3.12 —
quay 3.14 —
quay 3.15 —
quay 3.16 —
quay 3.17 —
quay 3.9 —
Red Hat Cluster Observability Operator 1.5.0 all versions
Red Hat Cryostat 4 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Gatekeeper 3 —
Red Hat Migration Toolkit for Applications 8 all versions
Red Hat Migration Toolkit for Virtualization —
Red Hat multicluster engine for Kubernetes 2.1 all versions
Red Hat multicluster engine for Kubernetes 2.11 all versions
Red Hat multicluster engine for Kubernetes 2.6 all versions
Red Hat multicluster engine for Kubernetes 2.8 all versions
Red Hat multicluster engine for Kubernetes 2.9 all versions
Red Hat Network Observability (NETOBSERV) 1.11.0 all versions
Red Hat Node HealthCheck Operator —
Red Hat OpenShift Lightspeed —
Red Hat OpenShift Pipelines all versions
Red Hat OpenShift Service Mesh 3 —
Red Hat Red Hat 3scale API Management Platform 2 —
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 all versions
Red Hat Red Hat Advanced Cluster Security 4.9 all versions
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 all versions
Red Hat Red Hat Developer Hub 1.8 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Migration Toolkit 1.8 all versions
Red Hat Red Hat Migration Toolkit for Applications 8.1 all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift AI 3.3 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.18 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.28 all versions
Red Hat Red Hat OpenShift Service Mesh 2.6 all versions
Red Hat Red Hat OpenShift Service Mesh 3.0 all versions
Red Hat Red Hat OpenShift Service Mesh 3.1 all versions
Red Hat Red Hat OpenShift Service Mesh 3.2 all versions
Red Hat Red Hat OpenShift Service Mesh 3.3 all versions
Red Hat Red Hat Quay 3.10 all versions
Red Hat Red Hat Quay 3.12 all versions
Red Hat Red Hat Quay 3.14 all versions
Red Hat Red Hat Quay 3.15 all versions
Red Hat Red Hat Quay 3.16 all versions
Red Hat Red Hat Quay 3.17 all versions
Red Hat Red Hat Quay 3.9 all versions
rhdh 1.8 —
rhdh 1.9 —
rhmt 1.8 —
service mesh 2.6 —
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —
service mesh 3.3 —

Referencias y parches

Coincidencias CPE (NVD) (1)
  • cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:* < 1.16.0