CVE-2026-107399
Description
A flaw was found in mechanize. When automatic meta refresh following is enabled, the library fails to restrict request headers across different web domains during a redirect. A remote attacker who controls web content during a crawl can redirect requests to an untrusted destination, leading to information disclosure of sensitive credentials such as session cookies and authorization tokens.
Statement
A moderate information disclosure flaw was found in the mechanize Ruby library, which is included in the Red Hat 3scale API Management Platform system container. When an application enables automatic meta refresh following (Mechanize#follow_meta_refresh, which is disabled by default) and configures default request headers through Mechanize#request_headers=, a crawled page containing a meta refresh pointing to another origin causes those configured headers to be reapplied to the cross-origin refresh request. A remote attacker who controls web content visited during a crawl can use this behavior to capture sensitive credentials, such as bearer tokens or session cookies, supplied in the default request headers. The default configuration is not affected, and the exposure is limited to caller-supplied default headers. Within Red Hat's product scope, only the 3scale API Management 2.15 stream is affected, and that stream is out of support scope, so no Red Hat update is planned for it; the residual risk is limited to deployments on that stream that enable meta refresh following while sending sensitive headers. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). The upstream CVE record scores the issue at 6.8 using a scope of changed (S:C); Red Hat assessed the scope as unchanged (S:U) because the mechanize client and the calling application operate within the same security authority.
Mitigation
A workaround is available: keep automatic meta refresh following disabled by leaving Mechanize#follow_meta_refresh at its default value of false, which is the non-affected default configuration. If meta refresh following must be enabled, avoid configuring sensitive headers such as Authorization or Cookie via Mechanize#request_headers= so that they are not replayed to cross-origin refresh targets. The affected Red Hat 3scale API Management 2.15 stream is out of support scope, so no Red Hat update is planned for it; upstream fixed this issue in mechanize version 2.14.1.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
