Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T16:31:46 webob: WebOb: Open redirect vulnerability leading to phishing and token theft 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CWE-601

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.

This is an open redirect vulnerability in the WebOb library. An unauthenticated attacker can craft a malicious URL that, when processed by applications utilizing WebOb for redirects, bypasses URL validation. This could lead to users being redirected to attacker-controlled sites, facilitating phishing attacks or the theft of authentication tokens, provided the user follows the redirect. Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present. Red Hat Quay 3.16 2026-09-21T00:00:00Z RHSA-2026:69255 quay/quay-rhel9:1789563753 Red Hat Ceph Storage 4 Fix deferred python-webob Red Hat Ceph Storage 7 Fix deferred rhceph/rhceph-7-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/rhceph-8-rhel9 Red Hat Enterprise Linux 6 Not affected python-webob Red Hat Enterprise Linux 7 Not affected python-webob Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ironic-agent-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ironic-rhel9 Red Hat OpenShift Container Platform 4 Not affected python-webob Red Hat OpenStack Platform 13 (Queens) Affected python-webob Red Hat OpenStack Platform 16.2 Affected python-webob Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-aodh-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-aodh-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-aodh-evaluator Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-aodh-listener Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-aodh-notifier Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-barbican-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-barbican-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-barbican-keystone-listener Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-barbican-worker Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ceilometer-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ceilometer-central Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ceilometer-compute Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ceilometer-ipmi Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ceilometer-notification Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-cinder-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-cinder-backup Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-cinder-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-cinder-scheduler Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-cinder-volume Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-backend-bind9 Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-central Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-mdns Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-producer Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-sink Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-designate-worker Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ec2-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-glance-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-gnocchi-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-gnocchi-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-gnocchi-metricd Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-gnocchi-statsd Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-heat-all Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-heat-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-heat-api-cfn Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-heat-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-heat-engine Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-horizon Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-conductor Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-inspector Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-neutron-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-ironic-pxe Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-keystone Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-manila-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-manila-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-manila-scheduler Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-manila-share Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-mistral-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-mistral-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-mistral-engine Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-mistral-event-engine Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-mistral-executor Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-agent-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-dhcp-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-l3-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-metadata-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-metadata-agent-ovn Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-openvswitch-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-server Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-server-ovn Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-neutron-sriov-agent Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-compute Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-compute-ironic Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-conductor Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-novajoin-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-novajoin-notifier Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-novajoin-server Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-libvirt Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-novncproxy Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-nova-scheduler Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-octavia-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-octavia-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-octavia-health-manager Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-octavia-housekeeping Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-octavia-worker Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-panko-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-placement-api Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-proxy-server Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-tempest Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-tripleoclient Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-zaqar-wsgi Red Hat OpenStack Platform 17.1 Affected python-webob Red Hat OpenStack Platform 18.0 Affected python-webob Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-aodh-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-aodh-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-aodh-evaluator-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-aodh-listener-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-aodh-notifier-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-barbican-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-barbican-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-barbican-keystone-listener-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-barbican-worker-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ceilometer-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ceilometer-central-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ceilometer-compute-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ceilometer-ipmi-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ceilometer-notification-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cinder-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cinder-backup-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cinder-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cinder-scheduler-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cinder-volume-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cloudkitty-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cloudkitty-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-cloudkitty-processor-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-backend-bind9-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-central-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-mdns-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-producer-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-sink-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-designate-worker-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-glance-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-heat-api-cfn-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-heat-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-heat-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-heat-engine-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-horizon-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-conductor-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-inspector-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-neutron-agent-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ironic-pxe-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-keystone-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-manila-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-manila-scheduler-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-manila-share-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-agent-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-dhcp-agent-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-metadata-agent-ovn-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-ovn-agent-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-server-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-neutron-sriov-agent-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-compute-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-conductor-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-novncproxy-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-nova-scheduler-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-octavia-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-octavia-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-octavia-health-manager-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-octavia-housekeeping-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-octavia-worker-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-openstackclient-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-ovn-bgp-agent-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-placement-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-proxy-server-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-tempest-all-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-watcher-api-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-watcher-applier-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-watcher-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-watcher-decision-engine-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 https://www.cve.org/CVERecord?id=CVE-2026-54770 https://nvd.nist.gov/vuln/detail/CVE-2026-54770 https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07 https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g https://github.com/Pylons/webob/tree/1.8.11