{"uuid": "8d9380e6-2724-4be7-9f16-669228ee8c20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4jc5-g844-4x33", "type": "seen", "source": "https://gist.github.com/alon710/d1939c63ece21d1bd9e89d2add282b5b", "content": "# CVE-2026-67435: CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67435\n\n## Summary\nCVE-2026-67435 is a security vulnerability in the linuxfabrik-lib Python library prior to version 6.0.0. When performing HTTP requests with follow_redirects enabled, custom authentication headers (such as X-Auth-Token or X-Api-Key) are forwarded during cross-origin redirects. A malicious or compromised server can leverage this behavior to capture sensitive monitoring and administrative credentials, leading to potential unauthorized access and Server-Side Request Forgery (SSRF).\n\n## TL;DR\nA vulnerability in linuxfabrik-lib prior to 6.0.0 forwards custom authentication headers (such as X-Auth-Token or X-Api-Key) during cross-origin redirects, allowing remote attackers to exfiltrate administrative credentials.\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.0\n- **EPSS Score**: 0.00286 (Percentile: 20.87%)\n- **Impact**: Credential Exposure\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- linuxfabrik-lib\n- Linuxfabrik Monitoring Plugins\n- **linuxfabrik-lib**: < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade linuxfabrik-lib to version 6.0.0 or higher.\n- Disable redirect handling by passing follow_redirects=False inside client calls.\n- Restrict network-level egress traffic for monitoring servers to prevent connection handshakes with external untrusted destinations.\n\n**Remediation Steps:**\n1. Identify all deployment instances of linuxfabrik monitoring scripts within local cronjobs, configuration modules, or service orchestrators.\n2. Update dependencies in requirements.txt or dependency lock files to specify linuxfabrik-lib>=6.0.0.\n3. Deploy the updated library package across all monitoring nodes and verify correct processing of monitoring endpoints.\n4. Apply strict firewall configurations restricting HTTP/HTTPS egress traffic from administrative monitoring subnets to verified destination systems.\n\n## References\n\n- [GitHub Security Advisory GHSA-4jc5-g844-4x33](https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-4jc5-g844-4x33)\n- [Fix Commit: Strip custom headers on cross-origin redirects](https://github.com/Linuxfabrik/lib/commit/6573ff9347e541200305d278d2663d2e54e052ff)\n- [linuxfabrik-lib Release v6.0.0](https://github.com/Linuxfabrik/lib/releases/tag/v6.0.0)\n- [NVD Record for CVE-2026-67435](https://nvd.nist.gov/vuln/detail/CVE-2026-67435)\n- [CVE.org Record for CVE-2026-67435](https://www.cve.org/CVERecord?id=CVE-2026-67435)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67435) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T01:31:12.318774Z"}