UBUNTU-CVE-2026-12547: Low severity ubuntu/libsoup2.4 vulnerability
Published Jul 21, 2026
·Updated
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
Affected Software
11 affected components
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
Event History
Jul 21, 2026
CVE Published
via OSV·07:17 PM
Data Sourced
via OSV·07:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which environments are exposed to this credential leak?
Systems using ubuntu/libsoup2.4 or ubuntu/libsoup3 are exposed when they use proxy authentication and the configured proxy can change. Proxy changes may occur through system settings or WPAD.
2
What conditions are required for credentials to be disclosed?
Proxy authentication credentials must already be cached for a previous proxy, and the proxy configuration must then switch to a different proxy. The cached Proxy-Authorization header can then be sent to the newly configured proxy.