{"id":"CVE-2026-113440","kind":"vulnerability","aliases":["CVE-2026-113440"],"related":[],"title":"hackney: same-host redirects leak Authorization and Cookie headers","description":"Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.","summary":"The hackney Erlang HTTP client resends Authorization and Cookie headers when a server redirects to the same host on a different scheme or port. An on-path attacker can read basic auth and cookie credentials sent over cleartext HTTP, or a different local service receives them.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","erlang","hackney","http-client","package"],"not_affected_if":["default-config","no-redirect-following","not-using-hackney"],"how_to_check":"- Check the hackney version in your `rebar.lock` or `mix.lock` (or the dependency tree) and confirm whether it is `2.0.0` or later but before `4.9.0`.\n- Look for calls with `follow_redirect` enabled that send `basic_auth` or `Cookie` headers.","fix":"- Upgrade hackney to `4.9.0` or later.\n- Until upgraded, disable `follow_redirect` for requests that carry credentials, or use `location_trusted` only for targets you control.","status":"open","published_at":"2026-10-26T14:16:28+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:42+00:00","updated_at":"2026-10-26T14:32:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:32:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hackney to `4.9.0` or later.\n- Until upgraded, disable `follow_redirect` for requests that carry credentials, or use `location_trusted` only for targets you control.","reach":"network","title":"hackney: same-host redirects leak Authorization and Cookie headers","impact":"medium","summary":"The hackney Erlang HTTP client resends Authorization and Cookie headers when a server redirects to the same host on a different scheme or port. An on-path attacker can read basic auth and cookie credentials sent over cleartext HTTP, or a different local service receives them.","category":"package","nicknames":[],"who_cares":["erlang","elixir","hackney","http-client"],"confidence":0.8,"needs_auth":"no","worst_case":"basic auth and cookie credentials exposed to on-path attacker or other service","analyst_note":"","how_to_check":"- Check the hackney version in your `rebar.lock` or `mix.lock` (or the dependency tree) and confirm whether it is `2.0.0` or later but before `4.9.0`.\n- Look for calls with `follow_redirect` enabled that send `basic_auth` or `Cookie` headers.","needs_analyst":false,"not_affected_if":["default-config","no-redirect-following","not-using-hackney"],"who_is_affected":"Applications that use hackney from 2.0.0 before 4.9.0 with redirect following enabled and that send Authorization or Cookie credentials through it. Exposure depends on a server returning a same-host redirect to a different scheme or port, so the risk is highest when clients talk to untrusted or on-path networks. Projects not using hackney, or not following redirects with credentials, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3492,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113440':13A,16A '-2026':12A,15A '2.0.0':200C '4.9.0':202C 'affect':197C 'allow':79C 'anoth':101C,171C 'attack':52B,163C 'auth':56B,87C,125C 'author':7A,30B,152C 'basic':55B,86C 'benoitc':77C 'cleartext':62B,157C 'client':22B,28B 'compar':129C 'cooki':9A,32B,58B,89C,154C 'credenti':59B,72C,90C,186C 'current':135C 'cve':11A,14A 'design':191C 'differ':44B,66B,181C 'elixir':17B 'enabl':108C 'erlang':18B,26B 'follow':106C,110C 'forward':185C 'hackney':1A,19B,25B,75C,78C,109C,122C,198C 'hand':177C 'header':10A,33B,155C 'host':4A,41B,98C,149C,176C 'hostnam':132C 'http':21B,27B,63B,145C 'http-client':20B 'https':143C 'insuffici':70C 'issu':196C 'leak':6A 'local':67B 'locat':119C,183C 'mayb':123C 'obtain':84C 'on-path':49B,160C 'packag':23B 'path':51B,162C 'port':47B,104C,172C 'protect':71C 'read':54B,165C 'receiv':69B 'redirect':5A,37B,81C,99C,107C,138C,141C,169C 'redirect/10':111C 'redirect/3':127C 'reissu':114C 'request':93C,116C 'resend':29B 'resent':150C 'same-host':2A,96C 'scheme':45B,102C 'sent':60B 'server':36B,82C 'servic':68B,182C 'src/hackney.erl':113C 'strip':124C 'target':120C,189C 'trust':184C 'unchang':194C 'url':139C 'via':94C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Applications that use hackney from 2.0.0 before 4.9.0 with redirect following enabled and that send Authorization or Cookie credentials through it. Exposure depends on a server returning a same-host redirect to a different scheme or port, so the risk is highest when clients talk to untrusted or on-path networks. Projects not using hackney, or not following redirects with credentials, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113440","severity":null,"published_at":"2026-10-26T14:16:28+00:00","modified_at":"2026-10-26T14:16:28+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}