CVE-2026-107715

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107715
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107715.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107715
Aliases
Downstream
Published
2026-10-08T21:27:24Z
Modified
2026-10-28T02:30:55Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Mechanize sends credential headers to another host after an HTTP redirect
Details

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107715.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "2.15.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/sparklemotion/mechanize

Affected ranges

Type
GIT
Repo
https://github.com/sparklemotion/mechanize
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a40941e3a29720850e5b6158340d78e239b4f9a5
Fixed
02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f
Fixed
94e0902867296be804f36eccbb47acf7d5018745
Fixed
ac49abf2869297d83c3b11bbfb8b18e63b588c95
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.14.1"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "fixed":  "02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "94e0902867296be804f36eccbb47acf7d5018745"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "ac49abf2869297d83c3b11bbfb8b18e63b588c95"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.14.1",
            "range":  [
                {
                    "fixed":  "a40941e3a29720850e5b6158340d78e239b4f9a5"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

REL_0.*
REL_0.7.6
REL_0.7.7
REL_0.7.8
REL_0.8.0
REL_0.8.2
REL_0.8.3
REL_0.8.4
REL_0.9.1
REL_0.9.2
REL_1.*
REL_1.0.0
v2.*
v2.0
v2.0.1
v2.0.pre.1
v2.0.pre.2
v2.1
v2.1.1
v2.1.pre.1
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.14.0
v2.2
v2.2.1
v2.3
v2.4
v2.5
v2.5.1
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.4.beta1
v2.7.4.beta2
v2.7.4.beta3
v2.7.5
v2.7.6
v2.7.7
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107715.json"