AIOHTTP divulgue les en-têtes Cookie et Proxy-Authorization lors d'une redirection inter-origine

The core impact of CVE-2026-34518 lies in the potential leakage of sensitive data contained within the Cookie and Proxy-Authorization headers. When aiohttp follows a redirect to a different origin, these headers are not properly handled, and their contents can be inadvertently exposed to unintended third parties. This could include authentication tokens, session identifiers, or other credentials that attackers could leverage to gain unauthorized access to backend systems or data. The risk is amplified in environments where these headers contain sensitive information, such as those utilizing proxy authentication or custom cookie-based authentication schemes. While the CVSS score is low, the potential for data exposure warrants immediate attention.

Applications and services built using aiohttp, particularly those that handle user authentication via cookies or proxy authentication, are at risk. This includes web applications, APIs, and microservices that rely on aiohttp for HTTP requests and redirection handling. Environments with legacy authentication schemes or custom cookie implementations are especially vulnerable.

• python / server:

import requests
from urllib.parse import urlparse

def check_redirect_headers(url):
    try:
        response = requests.get(url, allow_redirects=True, stream=True)
        for redirect in response.history:
            if urlparse(redirect.url).netloc != urlparse(response.url).netloc:
                print(f"Redirect to different origin detected: {redirect.url}")
                print(f"Cookie header: {response.cookies.get_dict()}")
                print(f"Proxy-Authorization header: {response.headers.get('Proxy-Authorization')}")
    except Exception as e:
        print(f"Error during request: {e}")

# Example usage
check_redirect_headers("http://example.com/redirect")

1. 2026-04-01Disclosure

   disclosure

2. 2026-04-01Patch

   patch

1. Réservé2026-03-30
2. Publiée2026-04-01
3. Modifiée2026-04-02
4. EPSS mis à jour2026-04-09

The primary mitigation for CVE-2026-34518 is to upgrade to aiohttp version 3.13.4 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include carefully scrutinizing redirect URLs to prevent redirection to untrusted origins, or implementing stricter header filtering policies at the proxy or web server level to strip out sensitive headers before they are passed to aiohttp. For environments utilizing reverse proxies, configure the proxy to handle redirects and header stripping. After upgrading, confirm the fix by sending a request that triggers a redirect and verifying that the Cookie and Proxy-Authorization headers are not included in the response.