CVE-2026-66339: Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Other sources
After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This means the destination server receives proxy credentials in cleartext (within the TLS session). Per HTTP standards, Proxy-Authorization should only appear on the CONNECT request itself, never on requests forwarded through the established tunnel. The proxy authentication logic in authmsgstarting() in libsoup/auth/soup-auth-manager.c runs unconditionally for all messages without checking whether the current request is being sent through an already-established CONNECT tunnel. This is distinct from CVE-2026-12547 which covers credential leak on proxy switch.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/534 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66339?
CVE-2026-66339 has a medium severity rating of 6.5.
How do I fix CVE-2026-66339?
To fix CVE-2026-66339, update to the latest version of libsoup where the vulnerability has been addressed.
What types of systems are affected by CVE-2026-66339?
CVE-2026-66339 affects applications using the Gnome libsoup library.
What does CVE-2026-66339 do?
CVE-2026-66339 allows the destination server to capture proxy credentials via the Proxy-Authorization header.
Is CVE-2026-66339 exploitable remotely?
Yes, CVE-2026-66339 is exploitable remotely as it involves HTTPS requests through an HTTP proxy.