CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Impact
When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULTREMOVEHEADERSONREDIRECT) — are stripped by default, as expected.
However, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl().urlopen(..., assertsamehost=False) still forward these sensitive headers.
Affected usage
Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connectionfromurl().
Remediation
Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection.
If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
Other sources
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl().urlopen(..., assertsamehost=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
— NVD
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/urllib3to a version that resolves this vulnerability.Fixed in 2.7.0 - Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.7.0 - Configuration
If upgrading is not immediately possible, avoid using the low-level redirect flow for cross-origin redirects: do not call cross-origin redirects through ProxyManager.connection_from_url().urlopen(..., assert_same_host=False).
urllib3 ProxyManager (low-level redirect flow) cross-origin redirect handling via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) = avoid (do not use this low-level redirect flow for cross-origin redirects) - Configuration
If appropriate for your use case, switch from the low-level redirect flow to urllib3 ProxyManager.request() for proxied requests.
urllib3 ProxyManager API choice for proxied requests with cross-origin redirects = ProxyManager.request()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44431?
CVE-2026-44431 has a moderate severity level due to the risk of exposing sensitive headers in cross-origin requests.
How do I fix CVE-2026-44431?
To mitigate CVE-2026-44431, upgrade urllib3 to version 2.7.0 or later.
Which versions of urllib3 are affected by CVE-2026-44431?
CVE-2026-44431 affects urllib3 versions from 1.23 up to, but not including, 2.7.0.
What are the implications of CVE-2026-44431?
CVE-2026-44431 can lead to the unintended transmission of sensitive headers, potentially compromising user privacy and security.
Can CVE-2026-44431 impact my application?
Yes, CVE-2026-44431 may impact applications using urllib3 for HTTP requests that follow cross-origin redirects.