CVE-2026-12547: Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch
https://gitlab.gnome.org/GNOME/libsoup/-/workitems/506 https://redhat.atlassian.net/browse/PSIRTSUPT-8846
Other sources
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12547?
The severity of CVE-2026-12547 is rated low with a score of 3.4.
How do I fix CVE-2026-12547?
To fix CVE-2026-12547, update Libsoup to the latest version where the credential caching issue is resolved.
What type of vulnerability is CVE-2026-12547?
CVE-2026-12547 is an information disclosure vulnerability related to cached proxy authentication credentials.
Which software is affected by CVE-2026-12547?
CVE-2026-12547 affects the Gnome Libsoup library.
What causes CVE-2026-12547?
CVE-2026-12547 is caused by SoupAuthManager caching proxy credentials without proper scoping to the proxy authority.