CVE-2018-20060: Infoleak
Last updated 18 August 2025
Other sources
python-urllib3 before version 1.23 does not remove the 'Authorization' HTTP header when following a cross-origin redirect. This can allow for credentials in the 'Authorization' header to be exposed as they are transmitted in plaintext.
Upstream Issues:
https://github.com/urllib3/urllib3/issues/1316 https://github.com/urllib3/urllib3/pull/1346
— Red Hat
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-20060?
CVE-2018-20060 is a vulnerability in urllib3 before version 1.23 that allows for credentials in the Authorization HTTP header to be exposed to unintended hosts or transmitted in cleartext.
What is the severity of CVE-2018-20060?
The severity of CVE-2018-20060 is critical with a severity value of 9.8.
How does CVE-2018-20060 affect urllib3?
CVE-2018-20060 affects urllib3 before version 1.23.
How can I fix CVE-2018-20060?
To fix CVE-2018-20060, upgrade urllib3 to version 1.23 or higher.
Where can I find more information about CVE-2018-20060?
You can find more information about CVE-2018-20060 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-20060), [GitHub Issue](https://github.com/urllib3/urllib3/issues/1316), [GitHub Pull Request](https://github.com/urllib3/urllib3/pull/1346).