EUVD-2026-46361
GHSA-gmf9-8jmv-v2q8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
AC:H reflects the specific proxy configuration change prerequisite; attacker needs only to operate a receiving proxy (PR:N); impact is limited to partial credential disclosure (C:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
AnalysisAI
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.
Technical ContextAI
libsoup is GNOME's HTTP client library (CPE: cpe:2.3:a:red_hat:red_hat_enterprise_linux_10), used extensively by GNOME desktop and system applications on Linux to handle HTTP and HTTPS requests. SoupAuthManager is libsoup's internal component responsible for caching and replaying authentication credentials across requests. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data): the credential cache is not scoped to the proxy authority tuple (host:port), so when a new proxy endpoint is designated - whether by user-modified system proxy settings or a Web Proxy Auto-Discovery (WPAD) response directing the client to a different server - SoupAuthManager replays the previously cached Proxy-Authorization header to the new proxy without verification. The upstream defect is tracked at https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506.
RemediationAI
The primary remediation is to apply the updated libsoup package for Red Hat Enterprise Linux 10 once released by Red Hat, referenced at https://access.redhat.com/security/cve/CVE-2026-12547. No specific patched libsoup version number is confirmed in available data; the upstream fix is in progress at https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506 but a tagged release has not been independently verified. As compensating controls, disable WPAD in environments where dynamic proxy configuration is not operationally required - this removes the most common automated trigger for proxy configuration changes. Restrict the ability to modify system proxy settings to privileged administrators to reduce the likelihood of an attacker-induced configuration change. Avoid Basic authentication schemes for proxy credentials where possible, favoring schemes that limit credential reuse. Note that these mitigations reduce exposure without eliminating the underlying flaw.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today