CVE-2026-44431
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 14, 2026
Updated · November 3, 2026
Description
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connection_from_url().urlopen() with assert_same_host=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-201 · Insertion of Sensitive Information Into Sent Data