CVE-2026-48856

What it is

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host. autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects. An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header. This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-06-10 16:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 11:10 UTC Last updatedMost recent change to the record

Details

Published

2026-06-10 16:17 UTC

Last modified

2026-10-26 11:10 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-601

Record status

Modified

Affected

• Erlang erlang\/inets < 9.3.2.6
• Erlang erlang\/inets < 9.6.2.2
• Erlang erlang\/inets < 9.7.1
• Erlang erlang\/otp < 27.3.4.13
• Erlang erlang\/otp < 28.5.0.2
• Erlang erlang\/otp < 29.0.2

Attack profile CVSS 4.0 · 7.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

High

Integrity

None

Availability

None