Vulnerability-Lookup

CVE-2026-48595 (GCVE-0-2026-48595)

Vulnerability from cvelistv5 – Published: 2026-06-02 19:08 – Updated: 2026-09-24 20:51

Title

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

Summary

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request. This issue affects tesla: from 1.4.0 before 1.18.3.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 15:59 UTC

CWE

CWE-178 - Improper Handling of Case Sensitivity

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 348 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/elixir-tesla/tesla/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48595.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48595	related
https://github.com/elixir-tesla/tesla/commit/2d93…	related
https://github.com/elixir-tesla/tesla/commit/db96…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
elixir-tesla	tesla	Affected: 1.4.0 , < 1.18.3 (semver) cpe:2.3:a:elixir-tesla:tesla::::::::
elixir-tesla	tesla	Affected: 2d937d5813d7cda5cd726f41824985fb655c920f , < db963dba67651b9abd1fc420a1d9679cf6efe182 (git) cpe:2.3:a:elixir-tesla:tesla::::::::

Date Public

2026-06-02 19:08

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48595",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:59:45.683092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:59:54.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
          ],
          "packageName": "tesla",
          "packageURL": "pkg:hex/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
          ],
          "packageName": "elixir-tesla/tesla",
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182",
              "status": "affected",
              "version": "2d937d5813d7cda5cd726f41824985fb655c920f",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must include \u003ccode\u003eTesla.Middleware.FollowRedirects\u003c/code\u003e in its Tesla middleware pipeline.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must include `Tesla.Middleware.FollowRedirects` in its Tesla middleware pipeline."
            }
          ],
          "value": "The application must include Tesla.Middleware.FollowRedirects in its Tesla middleware pipeline."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.18.3",
                  "versionStartIncluding": "1.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "datePublic": "2026-06-02T19:08:48.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Middleware.FollowRedirects\u003c/code\u003e strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (\u003ccode\u003e@filter_headers [\"authorization\", \"host\"]\u003c/code\u003e). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as \u003ccode\u003e{\"Authorization\", \"Bearer \u2026\"}\u003c/code\u003e (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a \u003ccode\u003eLocation:\u003c/code\u003e response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other \u003ccode\u003eAuthorization\u003c/code\u003e material on the cross-origin request.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 1.4.0 before 1.18.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\n`Tesla.Middleware.FollowRedirects` strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (`@filter_headers [\"authorization\", \"host\"]`). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as `{\"Authorization\", \"Bearer \u2026\"}` (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a `Location:` response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other `Authorization` material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
            }
          ],
          "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-267",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-267 Leverage Alternate Encoding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-178",
              "description": "CWE-178 Improper Handling of Case Sensitivity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:51:36.899Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
        },
        {
          "name": "EEF CNA record for CVE-2026-48595",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48595",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"
        },
        {
          "name": "Introducing commit 2d937d5 in elixir-tesla/tesla",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"
        },
        {
          "name": "Fix commit db963db in elixir-tesla/tesla",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNormalize all header keys to lowercase before passing them to Tesla. Use \u003ccode\u003e\"authorization\"\u003c/code\u003e instead of \u003ccode\u003e\"Authorization\"\u003c/code\u003e when setting headers via \u003ccode\u003eTesla.put_header/3\u003c/code\u003e or \u003ccode\u003eTesla.Middleware.Headers\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Normalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`."
            }
          ],
          "value": "Normalize all header keys to lowercase before passing them to Tesla. Use \"authorization\" instead of \"Authorization\" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48595",
    "datePublished": "2026-06-02T19:08:48.339Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-09-24T20:51:36.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48595",
      "date": "2026-11-01",
      "epss": "0.00487",
      "percentile": "0.41934"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
                ],
                "packageName": "tesla",
                "packageURL": "pkg:hex/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/middleware/follow_redirects.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "1.18.3",
                    "status": "affected",
                    "version": "1.4.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
                ],
                "packageName": "elixir-tesla/tesla",
                "packageURL": "pkg:github/elixir-tesla/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/middleware/follow_redirects.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182",
                    "status": "affected",
                    "version": "2d937d5813d7cda5cd726f41824985fb655c920f",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A796038-A843-4B88-83C9-22493F7482B0",
                    "versionEndExcluding": "1.18.3",
                    "versionStartIncluding": "1.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de manejo inadecuado de la distinci\u00f3n entre may\u00fasculas y min\u00fasculas en elixir-tesla tesla permite la fuga de credenciales a un origen de terceros en redirecciones de origen cruzado.\n\nTesla.Middleware.FollowRedirects elimina encabezados sensibles a la seguridad en redirecciones de origen cruzado utilizando una comparaci\u00f3n de cadenas que distingue entre may\u00fasculas y min\u00fasculas contra una lista de filtros en min\u00fasculas (@filter_headers [\u0027authorization\u0027, \u0027host\u0027]). Los nombres de los encabezados HTTP no distinguen entre may\u00fasculas y min\u00fasculas seg\u00fan la RFC 7230, pero Tesla conserva las claves de los encabezados textualmente tal como las proporciona el llamador sin normalizar las may\u00fasculas y min\u00fasculas. Un encabezado establecido como {\u0027Authorization\u0027, \u0027Bearer ...\u0027} (la capitalizaci\u00f3n can\u00f3nica de la RFC 7235 utilizada por pr\u00e1cticamente todas las bibliotecas y documentaci\u00f3n HTTP) no coincide con la entrada del filtro en min\u00fasculas y se reenv\u00eda al destino de la redirecci\u00f3n. Un atacante que puede controlar o influir en una respuesta Location: vista por el cliente (a trav\u00e9s de su propio punto final, un upstream de redirecci\u00f3n abierta o un origen comprometido) recibe el token de portador u otro material de autorizaci\u00f3n en la solicitud de origen cruzado.\n\nEste problema afecta a tesla: desde 1.4.0 antes de 1.18.3."
          }
        ],
        "id": "CVE-2026-48595",
        "lastModified": "2026-09-24T21:17:13.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48595",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:59:45.683092Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-02T20:16:38.390",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-178"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-03T22:01:19+00:00",
      "cve": "CVE-2026-48595",
      "id": "CVE-2026-48595",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48595.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48595",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-03T15:59:45.683092Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-03T15:59:29.063Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
              ],
              "packageName": "tesla",
              "packageURL": "pkg:hex/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/middleware/follow_redirects.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "1.18.3",
                  "status": "affected",
                  "version": "1.4.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
              ],
              "packageName": "elixir-tesla/tesla",
              "packageURL": "pkg:github/elixir-tesla/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/middleware/follow_redirects.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182",
                  "status": "affected",
                  "version": "2d937d5813d7cda5cd726f41824985fb655c920f",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must include \u003ccode\u003eTesla.Middleware.FollowRedirects\u003c/code\u003e in its Tesla middleware pipeline.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The application must include `Tesla.Middleware.FollowRedirects` in its Tesla middleware pipeline."
                }
              ],
              "value": "The application must include Tesla.Middleware.FollowRedirects in its Tesla middleware pipeline."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.18.3",
                      "versionStartIncluding": "1.4.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Yordis Prieto"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "datePublic": "2026-06-02T19:08:48.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Middleware.FollowRedirects\u003c/code\u003e strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (\u003ccode\u003e@filter_headers [\"authorization\", \"host\"]\u003c/code\u003e). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as \u003ccode\u003e{\"Authorization\", \"Bearer \u2026\"}\u003c/code\u003e (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a \u003ccode\u003eLocation:\u003c/code\u003e response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other \u003ccode\u003eAuthorization\u003c/code\u003e material on the cross-origin request.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 1.4.0 before 1.18.3.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\n`Tesla.Middleware.FollowRedirects` strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (`@filter_headers [\"authorization\", \"host\"]`). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as `{\"Authorization\", \"Bearer \u2026\"}` (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a `Location:` response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other `Authorization` material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
                }
              ],
              "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-267",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-267 Leverage Alternate Encoding"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-178",
                  "description": "CWE-178 Improper Handling of Case Sensitivity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-24T20:51:36.899Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
            },
            {
              "name": "EEF CNA record for CVE-2026-48595",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-48595",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"
            },
            {
              "name": "Introducing commit 2d937d5 in elixir-tesla/tesla",
              "tags": [
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"
            },
            {
              "name": "Fix commit db963db in elixir-tesla/tesla",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eNormalize all header keys to lowercase before passing them to Tesla. Use \u003ccode\u003e\"authorization\"\u003c/code\u003e instead of \u003ccode\u003e\"Authorization\"\u003c/code\u003e when setting headers via \u003ccode\u003eTesla.put_header/3\u003c/code\u003e or \u003ccode\u003eTesla.Middleware.Headers\u003c/code\u003e.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Normalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`."
                }
              ],
              "value": "Normalize all header keys to lowercase before passing them to Tesla. Use \"authorization\" instead of \"Authorization\" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48595",
        "datePublished": "2026-06-02T19:08:48.339Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-09-24T20:51:36.899Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48595

Vulnerability from fkie_nvd - Published: 2026-06-02 20:16 - Updated: 2026-09-24 21:17

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48595.html	Third Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182	Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m	Exploit, Vendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48595	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	elixir-tesla	tesla	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
          ],
          "packageName": "tesla",
          "packageURL": "pkg:hex/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027"
          ],
          "packageName": "elixir-tesla/tesla",
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Middleware.FollowRedirects\u0027:call/3"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182",
              "status": "affected",
              "version": "2d937d5813d7cda5cd726f41824985fb655c920f",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A796038-A843-4B88-83C9-22493F7482B0",
              "versionEndExcluding": "1.18.3",
              "versionStartIncluding": "1.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer \u2026\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de manejo inadecuado de la distinci\u00f3n entre may\u00fasculas y min\u00fasculas en elixir-tesla tesla permite la fuga de credenciales a un origen de terceros en redirecciones de origen cruzado.\n\nTesla.Middleware.FollowRedirects elimina encabezados sensibles a la seguridad en redirecciones de origen cruzado utilizando una comparaci\u00f3n de cadenas que distingue entre may\u00fasculas y min\u00fasculas contra una lista de filtros en min\u00fasculas (@filter_headers [\u0027authorization\u0027, \u0027host\u0027]). Los nombres de los encabezados HTTP no distinguen entre may\u00fasculas y min\u00fasculas seg\u00fan la RFC 7230, pero Tesla conserva las claves de los encabezados textualmente tal como las proporciona el llamador sin normalizar las may\u00fasculas y min\u00fasculas. Un encabezado establecido como {\u0027Authorization\u0027, \u0027Bearer ...\u0027} (la capitalizaci\u00f3n can\u00f3nica de la RFC 7235 utilizada por pr\u00e1cticamente todas las bibliotecas y documentaci\u00f3n HTTP) no coincide con la entrada del filtro en min\u00fasculas y se reenv\u00eda al destino de la redirecci\u00f3n. Un atacante que puede controlar o influir en una respuesta Location: vista por el cliente (a trav\u00e9s de su propio punto final, un upstream de redirecci\u00f3n abierta o un origen comprometido) recibe el token de portador u otro material de autorizaci\u00f3n en la solicitud de origen cruzado.\n\nEste problema afecta a tesla: desde 1.4.0 antes de 1.18.3."
    }
  ],
  "id": "CVE-2026-48595",
  "lastModified": "2026-09-24T21:17:13.173",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48595",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-03T15:59:45.683092Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T20:16:38.390",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-9M9W-GXF7-RH8M

Vulnerability from github – Published: 2026-07-10 00:03 – Updated: 2026-07-10 00:03

Summary

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Details

Summary

Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing ("Authorization") bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at.

Details

The filter list in lib/tesla/middleware/follow_redirects.ex is defined as @filter_headers ["authorization", "host"] and the membership check k not in @filter_headers compares the raw key string without case normalization. HTTP header names are case-insensitive per RFC 7230, but Tesla stores them verbatim. A header tuple {"Authorization", "Bearer …"} does not match "authorization", so it passes through the filter and is forwarded to the redirect destination unchecked. The same defect applies to the "Host" entry.

An attacker who can control a Location: response seen by the victim client (their own endpoint, a redirect-open service, or a compromised upstream) receives the credential on the cross-origin follow. No special configuration is required beyond the victim using the standard header casing.

PoC

Configure a Tesla client with Tesla.Middleware.FollowRedirects and set the Authorization header using canonical casing ({"Authorization", "Bearer <token>"}).
Make a request to an endpoint that returns a 302 redirect to a different origin.
Observe that the Authorization header with its value is present in the request delivered to the redirect destination.

Impact

High severity (CVSS v4.0: 8.2). Any application using tesla 1.4.0 through 1.18.2 with Tesla.Middleware.FollowRedirects and a non-lowercase Authorization header is affected. The workaround is to use all-lowercase "authorization" as the header key until upgrading to 1.18.3.

Workarounds

Normalize all header keys to lowercase before passing them to Tesla. Use "authorization" instead of "Authorization" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers.

Resources

Introduction commit: https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f
Patch commit: https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "tesla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.0"
            },
            {
              "fixed": "1.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-178"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-10T00:03:31Z",
    "nvd_published_at": "2026-06-02T20:16:38Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string `\"authorization\"`. Because Tesla preserves header keys exactly as supplied by the caller, any application that sets the header with its RFC 7235 canonical casing (`\"Authorization\"`) bypasses the filter entirely, leaking bearer tokens or other credentials to whatever origin the redirect points at.\n\n### Details\n\nThe filter list in `lib/tesla/middleware/follow_redirects.ex` is defined as `@filter_headers [\"authorization\", \"host\"]` and the membership check `k not in @filter_headers` compares the raw key string without case normalization. HTTP header names are case-insensitive per RFC 7230, but Tesla stores them verbatim. A header tuple `{\"Authorization\", \"Bearer \u2026\"}` does not match `\"authorization\"`, so it passes through the filter and is forwarded to the redirect destination unchecked. The same defect applies to the `\"Host\"` entry.\n\nAn attacker who can control a `Location:` response seen by the victim client (their own endpoint, a redirect-open service, or a compromised upstream) receives the credential on the cross-origin follow. No special configuration is required beyond the victim using the standard header casing.\n\n### PoC\n\n1. Configure a Tesla client with `Tesla.Middleware.FollowRedirects` and set the `Authorization` header using canonical casing (`{\"Authorization\", \"Bearer \u003ctoken\u003e\"}`).\n2. Make a request to an endpoint that returns a `302` redirect to a different origin.\n3. Observe that the `Authorization` header with its value is present in the request delivered to the redirect destination.\n\n### Impact\n\nHigh severity (CVSS v4.0: 8.2). Any application using `tesla` 1.4.0 through 1.18.2 with `Tesla.Middleware.FollowRedirects` and a non-lowercase `Authorization` header is affected. The workaround is to use all-lowercase `\"authorization\"` as the header key until upgrading to 1.18.3.\n\n### Workarounds\n\nNormalize all header keys to lowercase before passing them to Tesla. Use `\"authorization\"` instead of `\"Authorization\"` when setting headers via `Tesla.put_header/3` or `Tesla.Middleware.Headers`.\n\n### Resources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182",
  "id": "GHSA-9m9w-gxf7-rh8m",
  "modified": "2026-07-10T00:03:31Z",
  "published": "2026-07-10T00:03:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48595"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48595.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-tesla/tesla"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48595 (GCVE-0-2026-48595)

FKIE_CVE-2026-48595

GHSA-9M9W-GXF7-RH8M

Summary

Details

PoC

Impact

Workarounds

Resources

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour