EUVD-2026-26714
GHSA-375f-4r2h-f99j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections.
'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this function. Over a plaintext TCP connection, a client can declare https and Bandit will set conn.scheme = :https even though no TLS was negotiated.
Downstream Plug consumers that branch on conn.scheme are silently misled: Plug.SSL's already-secure branch skips its HTTP→HTTPS redirect, cookies emitted with secure: true are sent over plaintext, audit logs record requests as having arrived over HTTPS, and CSRF/SameSite gating may make incorrect decisions.
This issue affects bandit: from 1.0.0 before 1.11.0.
AnalysisAI
Transport-state spoofing in Bandit 1.0.0 through 1.10.x allows unauthenticated remote attackers to forge HTTPS connections over plaintext HTTP by supplying a malicious URI scheme in HTTP/1.1 absolute-form request targets or HTTP/2 :scheme pseudo-headers. The vulnerable determine_scheme/2 function returns client-supplied scheme values verbatim, causing downstream Plug middlewares to make incorrect security decisions: Plug.SSL skips HTTP→HTTPS redirects, secure cookies are transmitted unencrypted, and CSRF/SameSite protections may be bypassed. CVSS 6.3 (network-accessible, low complexity). Vendor patch available (version 1.11.0+).
Technical ContextAI
Bandit is an HTTP server for the Elixir/Erlang ecosystem built on Plug. The vulnerable code path is in lib/bandit/pipeline.ex:determine_scheme/2, which processes HTTP request metadata to populate the Plug connection struct's scheme field. In HTTP/1.1, clients can send absolute-form request targets (RFC 9110 Section 7.2) like GET https://victim/path HTTP/1.1 over plaintext TCP; similarly, HTTP/2 allows clients to set the :scheme pseudo-header to any value. The original implementation extracted and returned this client-controlled scheme directly without validating against the underlying transport's TLS status (the secure? boolean flag representing whether the socket negotiated TLS). This violates CWE-807 (Reliance on Untrusted Inputs in a Security Decision) by trusting attacker-controlled input where a security-critical decision (scheme := https vs http) should depend only on cryptographic transport properties. Downstream Plug consumers-including Plug.SSL middleware and applications performing conn.scheme-based branching-inherit this false signal, leading to logic errors in cookie security, redirect logic, logging, and CSRF token validation.
RemediationAI
Vendor-released patch: upgrade to Bandit version 1.11.0 or later. The patch refactors determine_scheme/2 to accept only the secure? boolean flag (representing the transport's TLS status) and discards the client-supplied request_target scheme parameter entirely, returning 'https' if secure?=true and 'http' otherwise. No upgrade path exists for versions prior to 1.0.0. Workarounds: For users unable to upgrade immediately, deploy Bandit behind a TLS-terminating reverse proxy (nginx, HAProxy) that strips or validates the :scheme pseudo-header and ensures the origin server observes only the proxy's own scheme header, preventing client spoofing. Additionally, configure Plug.SSL with explicit assume_secure: true if behind a trusted proxy, forcing all downstream logic to treat connections as HTTPS regardless of conn.scheme-note this disables the HTTP→HTTPS redirect and should only be used with a proxy that enforces TLS to clients. Audit downstream Plug middleware (especially custom authentication and cookie-handling code) for conn.scheme-based branches and add explicit transport-based checks using the socket's underlying state rather than relying on the scheme field. None of these workarounds fully eliminate the vulnerability; upgrade is the only complete fix.
Share
External POC / Exploit Code
Leaving vuln.today