8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44431

CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44431

CVE-2026-44431:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
urllib3	pip	>= 1.23, < 2.7.0	2.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the urlopen method of the HTTPConnectionPool class in urllib3. When handling redirects, this function was not configured to strip sensitive headers from requests made to a different origin. This flaw could be exploited if an application uses the low-level ProxyManager.connection_from_url().urlopen() API to make requests with assert_same_host=False, allowing an attacker to potentially capture sensitive information like authentication tokens or cookies by redirecting the client to a server under their control. The patch for this vulnerability, found in commit 5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc, introduces a check within the urlopen method. This check verifies if the redirect is to a different host and, if so, removes headers defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT before proceeding. This ensures that sensitive information is not leaked during cross-origin redirects.

Vulnerable functions

HTTPConnectionPool.urlopen

src/urllib3/connectionpool.py

The `urlopen` method in `HTTPConnectionPool` did not strip sensitive headers (like 'Authorization' or 'Cookie') when following a cross-origin redirect. This could lead to sensitive information being leaked to a third-party server. The vulnerability is specifically triggered when using the low-level API `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)`. The patch adds logic to remove these headers before the redirect is followed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.