Faraday Ruby Gem EUVD-2026-30966

Exploitation requires three concurrent conditions: (1) the target application uses a Faraday::Connection configured with a fixed base URL and connection-scoped headers (such as Authorization); (2) the application accepts attacker-controlled input and passes it through URI.parse() or equivalent, yielding a URI object rather than a plain String; and (3) that URI object is then supplied directly to a Faraday request method such as conn.get(), conn.post(), or req.url(). The bypass is specifically gated on the input being a URI object - applications that pass only String values to Faraday are protected by the prior CVE-2026-25765 fix and are NOT affected. Exploitation is further limited to Faraday versions 2.0.0-2.14.1; applications running 2.14.2 or later are patched. No authentication against the target application is required by the attacker (PR:N per CVSS vector). The attacker does not need network adjacency - this is a fully remote, network-accessible attack path.

The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) attributes zero impact across all dimensions, which directly conflicts with the demonstrated behavior: the published PoC exfiltrates Authorization: Bearer <token> credentials to an attacker-controlled host. This vector appears to be a placeholder or scoring error, not an accurate impact assessment - security teams must NOT rely on the CVSS score as a risk signal for this CVE. The attack vector attributes (AV:N/AC:L/PR:N/UI:N) are consistent with the description and are credible. No EPSS score was provided in the available data. No CISA KEV listing was present, meaning active exploitation is not confirmed by a government threat feed, though publicly available exploit code exists. The bypass nature of this vulnerability is a significant risk amplifier: organizations that patched CVE-2026-25765 and believe they are protected are not, if their application ever passes URI objects to Faraday. Any Ruby application that accepts user input, parses it with URI.parse(), and passes the result to a Faraday connection with default Authorization headers is a high-priority remediation target.

An attacker submits a crafted protocol-relative URI string - such as //attacker.example/collect - to an application endpoint that parses user input with URI.parse() and passes the resulting URI object to a Faraday connection method (conn.get(), conn.post()). The application, which configures a fixed base URL of http://trusted.example/api with a default Authorization: Bearer <token> header, dispatches the request to the attacker's host instead, forwarding the bearer token in full. The published proof-of-concept in GHSA-5rv5-xj5j-3484 confirms this flow was successfully executed against both a local WEBrick listener and a public HTTP collector, returning HTTP 200 with the leaked token visible in the captured request.