EUVD-2026-46361
GHSA-gmf9-8jmv-v2q8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
AC:H reflects the specific proxy configuration change prerequisite; attacker needs only to operate a receiving proxy (PR:N); impact is limited to partial credential disclosure (C:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
AnalysisAI
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) a libsoup-based application must have a prior session where it successfully authenticated to a proxy, leaving credentials cached in SoupAuthManager with no binding to the original proxy host:port; (2) the system proxy configuration must change mid-session - specifically the proxy host, port, or both must differ from the configuration under which credentials were cached, triggered via manual system settings change, WPAD/PAC response change, or network-level DHCP/DNS manipulation; and (3) the newly configured proxy endpoint must be attacker-controlled or observable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 3.4 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N is low, reflecting partial confidentiality impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating a rogue proxy endpoint positions it to become the victim system's active proxy - either by poisoning a WPAD DNS or DHCP response, or by being the destination of a pushed proxy configuration change via Group Policy. When a GNOME application on the victim's RHEL 10 system makes its next HTTP request, libsoup's SoupAuthManager forwards the cached Proxy-Authorization header from the previous legitimate proxy session to the attacker's proxy, delivering the victim's proxy credentials. … |
| Remediation | The primary remediation is to apply the updated libsoup package for Red Hat Enterprise Linux 10 once released by Red Hat, referenced at https://access.redhat.com/security/cve/CVE-2026-12547. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today