CVE-2026-88059

A flaw was found in Angular. When Server-Side Rendering (SSR) and hydration are used with a hierarchical HttpClient configured with withRequestsMadeViaParent, the HttpTransferCache can improperly cache authenticated responses. This occurs because a child TransferCache stores private response data in TransferState even when a parent HttpClient chain adds credentials and skips the authenticated request. Consequently, a later unauthenticated or unauthorized visitor could receive cached HTML containing sensitive data from a previously authenticated user, leading to information disclosure.

This vulnerability is evaluated as having a Moderate impact for Red Hat products because potential data exposure requires a highly specific, non-standard application architecture and shared caching infrastructure. In typical Red Hat deployments, Angular is utilized client-side within administrative consoles and standalone web applications rather than in Server-Side Rendering environments that transfer serialized state to end users. Exploitation is further constrained by requiring parent-level credential delegation across nested HTTP clients alongside intermediate reverse proxies or edge caches storing rendered responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.