CVE-2026-8368: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Q: What conditions are required for credential disclosure?

An application must use an affected LWP::UserAgent version, supply Authorization or Proxy-Authorization headers, and follow a 3xx redirect. Disclosure occurs when that redirect changes the scheme, host, or port and points to an attacker-controlled destination.

Q: Which credentials can be exposed?

Caller-supplied Authorization and Proxy-Authorization header values can be sent to the cross-origin redirect target. The issue does not affect Host or Cookie headers, which the redirect handler already strips.

Q: How can I determine whether an application is affected?

Check whether it uses LWP::UserAgent from libwww-perl before version 6.83 and whether it makes requests with Authorization or Proxy-Authorization headers that may follow redirects. Review redirect behavior for destination changes in scheme, hostname, or port.

Q: What can be done before upgrading?

Avoid automatically following redirects for requests that include Authorization or Proxy-Authorization headers, or ensure redirects cannot lead to untrusted origins. Do not send these headers on follow-up requests when the redirect changes scheme, host, or port.

Published May 12, 2026

Updated

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Affected Software

5 affected componentsFixes available

cpan/libwww-perl<6.83

Microsoft azl3 perl-libwww-perl 6.72-1

Patch available

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LWP::UserAgent (libwww-perl) to a version that resolves this vulnerability.
Fixed in 6.83

Event History

May 12, 2026

CVE Published

via MITRE·02:01 PM

Data Sourced

via MITRE·02:01 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

May 17, 2026

Data Sourced

via Microsoft·08:01 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·08:01 AM

DescriptionSeverity

Aug 15, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

What conditions are required for credential disclosure?

An application must use an affected LWP::UserAgent version, supply Authorization or Proxy-Authorization headers, and follow a 3xx redirect. Disclosure occurs when that redirect changes the scheme, host, or port and points to an attacker-controlled destination.

Which credentials can be exposed?

Caller-supplied Authorization and Proxy-Authorization header values can be sent to the cross-origin redirect target. The issue does not affect Host or Cookie headers, which the redirect handler already strips.

How can I determine whether an application is affected?

Check whether it uses LWP::UserAgent from libwww-perl before version 6.83 and whether it makes requests with Authorization or Proxy-Authorization headers that may follow redirects. Review redirect behavior for destination changes in scheme, hostname, or port.

What can be done before upgrading?

Avoid automatically following redirects for requests that include Authorization or Proxy-Authorization headers, or ensure redirects cannot lead to untrusted origins. Do not send these headers on follow-up requests when the redirect changes scheme, host, or port.

CVE-2026-8368: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What conditions are required for credential disclosure?

Which credentials can be exposed?

How can I determine whether an application is affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for credential disclosure?

Which credentials can be exposed?

How can I determine whether an application is affected?

What can be done before upgrading?