CVE-2026-67435: CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib

#security #cve #cybersecurity

CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib

Vulnerability ID: CVE-2026-67435
CVSS Score: 6.0
Published: 2026-07-30

CVE-2026-67435 is a security vulnerability in the linuxfabrik-lib Python library prior to version 6.0.0. When performing HTTP requests with follow_redirects enabled, custom authentication headers (such as X-Auth-Token or X-Api-Key) are forwarded during cross-origin redirects. A malicious or compromised server can leverage this behavior to capture sensitive monitoring and administrative credentials, leading to potential unauthorized access and Server-Side Request Forgery (SSRF).

TL;DR

A vulnerability in linuxfabrik-lib prior to 6.0.0 forwards custom authentication headers (such as X-Auth-Token or X-Api-Key) during cross-origin redirects, allowing remote attackers to exfiltrate administrative credentials.

Technical Details

CWE ID: CWE-200, CWE-918
Attack Vector: Network
CVSS v4.0 Score: 6.0
EPSS Score: 0.00286 (Percentile: 20.87%)
Impact: Credential Exposure
Exploit Status: None
KEV Status: Not Listed

Affected Systems

linuxfabrik-lib
Linuxfabrik Monitoring Plugins
linuxfabrik-lib: < 6.0.0 (Fixed in: 6.0.0)

Code Analysis

Commit: 6573ff9

Strip credentials / custom headers on cross-origin redirect

@@ -0,0 +1,41 @@
+_REDIRECT_SAFE_HEADERS = frozenset({
+    'accept',
+    'accept-encoding',
+    'accept-language',
+    'connection',
+    'content-length',
+    'content-type',
+    'host',
+    'transfer-encoding',
+    'user-agent',
+})
+...

Mitigation Strategies

Upgrade linuxfabrik-lib to version 6.0.0 or higher.
Disable redirect handling by passing follow_redirects=False inside client calls.
Restrict network-level egress traffic for monitoring servers to prevent connection handshakes with external untrusted destinations.

Remediation Steps:

Identify all deployment instances of linuxfabrik monitoring scripts within local cronjobs, configuration modules, or service orchestrators.
Update dependencies in requirements.txt or dependency lock files to specify linuxfabrik-lib>=6.0.0.
Deploy the updated library package across all monitoring nodes and verify correct processing of monitoring endpoints.
Apply strict firewall configurations restricting HTTP/HTTPS egress traffic from administrative monitoring subnets to verified destination systems.

References

Read the full report for CVE-2026-67435 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community