CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib

The component linuxfabrik-lib is a utility library developed by Linuxfabrik GmbH, primarily used to support enterprise monitoring plugins. Within this library, the HTTP client utility lib.url.fetch() streamlines network interactions by wrapping the HTTP client library httpx. These utilities are routinely deployed within automation scripts and infrastructure monitoring frameworks to query internal networks and device endpoints.

By default, lib.url.fetch() configures the HTTP client with automatic redirection capabilities (follow_redirects=True). Because monitoring configurations frequently rely on persistent authentication mechanisms to query endpoints, sensitive tokens are passed via HTTP headers. This exposure creates a broad attack surface if a monitored endpoint is compromised or misconfigured to yield redirection paths.

The vulnerability belongs to the CWE-200 (Exposure of Sensitive Information) and CWE-918 (Server-Side Request Forgery) classes. Under certain conditions, a target device can coerce the client library into leaking critical administrative credentials to arbitrary external domains. This bypasses the security zone separation established within monitoring environments.

The underlying flaw arises from how the HTTP client engine manages cross-origin redirects. While standard HTTP libraries, including httpx, strip default authentication headers such as Authorization or Cookie upon encountering cross-origin HTTP 3xx redirects, they lack context regarding proprietary or application-specific headers. Consequently, custom headers remain attached to the redirected request.

In infrastructure monitoring contexts, plugins frequently query out-of-band management platforms, such as Redfish APIs. These APIs rely on proprietary authentication schemes, using custom headers like X-Auth-Token or vendor-specific API keys like X-Api-Key. Because these headers do not match the standardized standard list of credential headers, the client continues to transmit them when executing cross-origin redirection hops.

An attacker who can influence the destination of the HTTP query can manipulate the host to return a 302 Found or 307 Temporary Redirect response. If the client automatically follows the redirect, the custom authentication header is dispatched directly to the target system controlled by the attacker. This configuration results in direct credential exposure without requiring complex exploit payloads or privilege escalations.

The vulnerability was remediated in commit 6573ff9347e541200305d278d2663d2e54e052ff by implementing custom header filtering on redirect events. The patch introduces a static list of trusted transport headers, designated as _REDIRECT_SAFE_HEADERS. These headers are deemed safe for transfer across security domains because they do not carry user-specific credentials.

# Safe headers to keep when redirecting across origins
_REDIRECT_SAFE_HEADERS = frozenset({
    'accept',
    'accept-encoding',
    'accept-language',
    'connection',
    'content-length',
    'content-type',
    'host',
    'transfer-encoding',
    'user-agent',
})

To determine whether a redirection hop represents a cross-origin boundary crossing, the developers implemented origin-matching logic. The function evaluates if the scheme, host, or port changes during transit, excluding standard HTTP-to-HTTPS upgrades on the same host.

def _leaks_credentials_on_redirect(src, dst):
    # Compare source and destination origins
    same_origin = (
        src.scheme == dst.scheme
        and src.host == dst.host
        and _default_port(src) == _default_port(dst)
    )
    if same_origin:
        return False
    # Allow standard http to https upgrades
    https_upgrade = (
        src.host == dst.host
        and src.scheme == 'http'
        and _default_port(src) == 80
        and dst.scheme == 'https'
        and _default_port(dst) == 443
    )
    return not https_upgrade

To apply this logic to the httpx.Client without modifying the global package namespace, the patching code interceptively shadows the private _redirect_headers method of the instance. If a cross-origin transfer is detected, non-whitelisted headers are explicitly deleted.

def _install_safe_redirect_stripping(client):
    original = getattr(client, '_redirect_headers', None)
    if original is None:
        return client
 
    def _redirect_headers(request, url, method):
        headers = original(request, url, method)
        if _leaks_credentials_on_redirect(request.url, url):
            for name in list(headers.keys()):
                if name.lower() not in _REDIRECT_SAFE_HEADERS:
                    del headers[name]
        return headers
 
    client._redirect_headers = _redirect_headers
    return client

> [!WARNING] > While this patch effectively closes the vulnerability, it exhibits potential robustness issues. It monkey-patches _redirect_headers, a private internal method of the httpx module. Because private methods are subject to change in minor version updates of httpx, future modifications to the internal signature of httpx could disable the security wrapper without causing standard execution runtime errors.

An execution scenario involves an attacker targeting internal monitoring infrastructure. The attacker identifies a monitored target device or service that has been compromised, or whose DNS records can be spoofed. Alternatively, the target endpoint may allow user-supplied URI injection, permitting an attacker to manipulate the redirect destinations.

In the first stage, the monitoring agent initiates a routine poll to the target device using the vulnerable library. The request includes custom credentials, such as an X-Auth-Token header containing administrative session data. Because the device is compromised or configured to act maliciously, it responds with an HTTP redirect code pointing to http://evil.local.

The vulnerable lib.url.fetch() utility intercepts the redirect and processes the redirection automatically. It instantiates a new HTTP request targeting http://evil.local but fails to strip the custom header. Upon receipt, the attacker-controlled server extracts the X-Auth-Token value from the request headers, granting the attacker administrative privileges over the monitored system.

The potential consequences of CVE-2026-67435 are severe, particularly because it directly exposes out-of-band management endpoints. These platforms control server hardware, firmware updates, and core hypervisor systems. If an administrative Redfish token is leaked, attackers can gain console access or modify hardware configurations.

The vulnerability is assigned a CVSS v4.0 base score of 6.0, indicating a Medium severity issue. While the attack is relatively simple once a redirect path is established, the exploitation is bounded by the need to intercept or manipulate target network responses. The Confidentiality vector is rated High because complete session tokens are exposed.

Because this vulnerability is not currently listed in the CISA KEV catalog and lacks weaponized exploitation scripts, the immediate exploitation threat remains low. However, custom automation scripts that interact with third-party APIs represent an overlooked vector for silent credential harvest.

The primary remediation path requires upgrading linuxfabrik-lib to version 6.0.0 or higher. This version contains the dynamic patching wrapper that intercepts and filters redirected request headers, safeguarding custom security context during origin crossings.

If patching cannot be executed immediately, administrators must secure their execution environment using secondary controls. Egress firewalls on monitoring agent hosts should be restricted to prevent outgoing traffic to unauthorized IP addresses and domains. Monitoring agents should only communicate with known, whitelisted internal resources.

Additionally, developers can configure the library to disable redirection parsing globally when executing authenticated HTTP queries. Passing follow_redirects=False within calling functions prevents the client library from automatically navigating redirect pathways, neutralizing the primary attack vector.