CVE-2026-39807
Description
A flaw was found in bandit. An unauthenticated client can exploit this vulnerability by spoofing the transport state on plaintext HTTP connections. By declaring an HTTPS scheme over a non-secure TCP connection, the system incorrectly registers the connection as secure. This can lead to sensitive cookies being sent over plaintext, bypassing security redirects, and potentially affecting Cross-Site Request Forgery (CSRF) and SameSite protections, resulting in information disclosure and security bypass.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, ensure that all `bandit` deployments are configured to operate exclusively behind a TLS-terminating proxy. This setup prevents direct plaintext HTTP connections from reaching the `bandit` application, thereby eliminating the vector for transport-state spoofing. If `bandit` is directly exposed via HTTP, it is vulnerable.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability,Other
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
Attackers can bypass the security decision to access whatever is being protected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
