CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Impact
When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULTREMOVEHEADERSONREDIRECT) — are stripped by default, as expected.
However, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl().urlopen(..., assertsamehost=False) still forward these sensitive headers.
Affected usage
Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through HTTPConnection.urlopen() instances created via ProxyManager.connectionfromurl().
Remediation
Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by HTTPConnection.
If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to ProxyManager.request().
Other sources
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl().urlopen(..., assertsamehost=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
— MITRE
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/urllib3to a version that resolves this vulnerability.Fixed in 2.7.0 - Upgrade
Upgrade
debian/python-urllib3to a version that resolves this vulnerability.Fixed in 1.26.12-1+deb12u4Fixed in 2.3.0-3+deb13u2Fixed in 2.7.0-3Fixed in 2.8.0-1 - Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.7.0 - Configuration
Use ProxyManager.request() instead of the low-level HTTPConnection.urlopen(..., assert_same_host=False) redirect flow when making proxied requests.
urllib3 ProxyManager request API = ProxyManager.request()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44431?
CVE-2026-44431 has a moderate severity level due to the risk of exposing sensitive headers in cross-origin requests.
How do I fix CVE-2026-44431?
To mitigate CVE-2026-44431, upgrade urllib3 to version 2.7.0 or later.
Which versions of urllib3 are affected by CVE-2026-44431?
CVE-2026-44431 affects urllib3 versions from 1.23 up to, but not including, 2.7.0.
What are the implications of CVE-2026-44431?
CVE-2026-44431 can lead to the unintended transmission of sensitive headers, potentially compromising user privacy and security.
Can CVE-2026-44431 impact my application?
Yes, CVE-2026-44431 may impact applications using urllib3 for HTTP requests that follow cross-origin redirects.