Elixir Tesla EUVD-2026-34014

The target application must (a) depend on elixir-tesla/tesla in the range 1.4.0 to 1.18.2, (b) include Tesla.Middleware.FollowRedirects in its middleware stack, (c) attach a sensitive header - Authorization or Host - using any casing other than fully lowercase (the RFC 7235 canonical 'Authorization' form, which is the default in virtually all examples and SDKs, triggers the bug), and (d) issue a request whose response chain includes a redirect to a host, port, or scheme controlled or influenced by the attacker. Limiting factors: applications that happen to set headers in lowercase ({"authorization", ...}) are not vulnerable; applications that disable redirect following or only call fixed, trusted endpoints with no attacker-influenced redirect path are not exploitable in practice; and only confidentiality of in-flight credentials is at risk (CVSS VI:N/VA:N) - there is no direct code execution or integrity impact.

The CVSS 4.0 base score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) reflects a network-reachable, low-complexity, unauthenticated confidentiality-only impact, with the AT:P (Attack Requirements: Present) flag correctly modeling the need for a redirect-triggering condition. Real-world risk is meaningful but bounded: exploitation requires the Tesla-using application to (1) attach an Authorization header in non-lowercase form, (2) enable Tesla.Middleware.FollowRedirects, and (3) issue a request whose response redirects to an attacker-influenced host. Conditions 1 and 2 are both common defaults - Elixir HTTP-client examples overwhelmingly use 'Authorization' canonical casing, and FollowRedirects is a frequently added middleware - so the residual gate is the redirect itself, which is plausible against any service that performs outbound HTTP to third-party or user-supplied URLs (webhooks, URL previewers, OAuth callbacks pointed at attacker domains, federation clients). No EPSS score, KEV listing, or public POC was provided in the input, and no SSVC decision is available; the exploitation status is therefore no public exploit identified at time of analysis, consistent with this being a recently disclosed library-level credential-leak rather than a mass-exploited internet-facing flaw.

An Elixir service uses Tesla with FollowRedirects to call a third-party API, attaching {"Authorization", "Bearer <token>"} (canonical casing) on each request. The attacker controls or compromises a URL the service fetches - for example, a user-submitted webhook target, an OAuth redirect_uri, a URL-preview unfurler input, or an upstream service the attacker has gained influence over - and returns HTTP 302 Location: https://attacker.example/collect. Tesla follows the redirect and, because the lowercase filter fails to match 'Authorization', replays the bearer token against the attacker's host, where it is captured and used to impersonate the victim service against the legitimate API.