---
id: "CVE-2026-113440"
kind: "vulnerability"
aliases: ["CVE-2026-113440"]
title: "hackney: same-host redirects leak Authorization and Cookie headers"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "erlang", "hackney", "http-client", "package"]
not_affected_if: ["default-config", "no-redirect-following", "not-using-hackney"]
published_at: "2026-10-26T14:16:28+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113440", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# hackney: same-host redirects leak Authorization and Cookie headers

The hackney Erlang HTTP client resends Authorization and Cookie headers when a server redirects to the same host on a different scheme or port. An on-path attacker can read basic auth and cookie credentials sent over cleartext HTTP, or a different local service receives them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the hackney version in your `rebar.lock` or `mix.lock` (or the dependency tree) and confirm whether it is `2.0.0` or later but before `4.9.0`.
- Look for calls with `follow_redirect` enabled that send `basic_auth` or `Cookie` headers.

## Fix

- Upgrade hackney to `4.9.0` or later.
- Until upgraded, disable `follow_redirect` for requests that carry credentials, or use `location_trusted` only for targets you control.

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113440

## From the sources

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.

This issue affects hackney: from 2.0.0 before 4.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_