CVE-2026-121971
Description
A flaw was found in Symfony HttpClient. The scoped HTTP client attaches default authentication credentials to requests before verifying that the resolved destination matches the intended trusted domain. A remote attacker who can control or influence the target URL can supply a specially crafted relative address that redirects the request to an external server. This flaw leads to information disclosure, potentially exposing sensitive authentication tokens and passwords to an attacker-controlled system.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger the transmission of high-value authentication credentials to arbitrary hosts without requiring special privileges. In typical Red Hat environments, Symfony HttpClient is utilized within custom PHP applications and services; the risk is realized only when applications construct outbound requests using user-controlled relative paths against pre-configured authentication scopes. Applications that strictly validate or restrict outbound request targets, or those that do not utilize scoped credential configurations, are not exposed to this risk.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure ScopingHttpClient verifies that the resolved URL matches the base URI scheme and authority before attaching default scope authentication credentials: upgrade to symfony/http-client 5.4.56, 6.4.50, 7.4.23, 8.1.11, which compare the scheme and authority of the resolved URL against the base URI and reset default scope options if they differ, closing all 3 injection vectors (network-path reference injection, URL authority manipulation via alternate port, URL authority manipulation via user-info). Until patched, this is a concern on PHP applications using Symfony ScopingHttpClient or HttpClient::createForBaseUri with default scope credentials and user-influenced target URLs, so Strictly validate and sanitize target URLs and paths passed to scoped HTTP clients to reject network-path references and ensure authority or port modifications cannot be injected. These controls limit blast radius and contain exploitation, but they do not fix the underlying credential disclosure defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
