HTTP::Tiny Credential Header Exposure in Redirects

Executive Summary

CVE-2026-7017 is a security vulnerability in the Perl HTTP::Tiny module versions before 0.095. The issue arises when the module follows HTTP 3xx redirects without properly checking if the redirect target shares the same origin as the original URL. Specifically, the module forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization to cross-origin redirect targets, including cases where the redirect downgrades from HTTPS to HTTP, exposing these credentials in plaintext.

This means that when a server responds with a redirect, HTTP::Tiny merges the caller's headers into the new request without verifying the destination's origin, potentially leaking sensitive authentication information to untrusted or malicious hosts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unintended exposure of sensitive authentication credentials such as Authorization headers and cookies to untrusted third-party domains during HTTP redirects. An attacker controlling a redirect target could capture these credentials, potentially gaining unauthorized access to protected resources or user accounts.

Additionally, the vulnerability allows HTTPS to HTTP downgrade redirects, which exposes credentials in plaintext over the network, increasing the risk of interception by attackers.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-7017, update HTTP::Tiny to version 0.095 or later where the vulnerability is fixed.

The fix includes refusing HTTPS to HTTP redirects by default to prevent downgrade attacks and stripping Authorization, Cookie, and Proxy-Authorization headers on cross-origin redirects to avoid credential leakage.

If you must allow legacy behavior, explicitly set the new parameters `allow_downgrade` and `allow_credentialed_redirects` to true, but this is discouraged due to security risks.

Review your usage of HTTP::Tiny in your Perl applications to ensure these updated security settings are applied.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in HTTP::Tiny causes sensitive authentication credentials such as Authorization, Cookie, and Proxy-Authorization headers to be forwarded to cross-origin redirect targets, including insecure HTTP endpoints after HTTPS downgrades. This behavior can lead to credential leakage to untrusted domains.

Such leakage of sensitive authentication information can result in unauthorized access to protected resources and exposure of personal or confidential data, which may violate data protection requirements under regulations like GDPR and HIPAA.

The vulnerability increases the risk of non-compliance with these standards because it undermines the confidentiality and integrity of user credentials and potentially exposes personal data during HTTP redirects.

The fixes introduced in HTTP::Tiny, including stripping authentication headers on cross-origin redirects by default and refusing HTTPS to HTTP downgrades, help mitigate these risks and support compliance by preventing unintended credential exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves HTTP::Tiny versions before 0.095 forwarding credential headers (Authorization, Cookie, Proxy-Authorization) to cross-origin redirect targets, including HTTPS to HTTP downgrades, which can expose sensitive credentials.

To detect this vulnerability on your system, you should first identify if your Perl environment uses HTTP::Tiny versions prior to 0.095.

• Check the installed HTTP::Tiny version with the Perl command: perl -MHTTP::Tiny -e 'print $HTTP::Tiny::VERSION, "\n"'
• Review your application or scripts for usage of HTTP::Tiny and whether they handle redirects that might cross origins or downgrade from HTTPS to HTTP.
• Monitor network traffic for HTTP requests that include Authorization or Cookie headers being sent to unexpected domains, especially after redirects.
• Use network packet capture tools like tcpdump or Wireshark to capture HTTP traffic and filter for requests containing sensitive headers sent to different origins after redirects.
• Example tcpdump command to capture HTTP traffic with Authorization headers: tcpdump -i any -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i Authorization
• Check application logs for unexpected redirects or credential forwarding behavior.

Since the vulnerability is specific to HTTP::Tiny's handling of redirects and headers, detection primarily involves verifying the HTTP::Tiny version and monitoring for credential leakage during redirects.

Useful 0 Not Useful 0