CVE-2026-48595Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
- 8.2HighCVSS base score
- 0.49%Exploitation in 30 daysEPSS · top 57% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request. This issue affects tesla: from 1.4.0 before 1.18.3.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits1
References tagged exploit1 reference
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m (opens in a new tab)vendor-advisoryrelatedexploit
Timeline
ID reserved
By EEF
- 11 days later
· 11 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | High8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Modified | 4.0 | High8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.49% · top 57% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Affected products
- affected 1.4.0 – < 1.18.3
- affected 2d937d5813d7cda5cd726f41824985fb655c920f – < db963dba67651b9abd1fc420a1d9679cf6efe182
Affected packages
From reviewed advisories of the GitHub Advisory Database.
What to do
Workaround: Normalize all header keys to lowercase before passing them to Tesla. Use "authorization" instead of "Authorization" when setting headers via Tesla.put_header/3 or Tesla.Middleware.Headers.
References
References5
- https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m (opens in a new tab)vendor-advisoryrelatedexploit
- EEF CNA record for CVE-2026-48595 (opens in a new tab)related
- OSV record EEF-CVE-2026-48595 (opens in a new tab)related
- Introducing commit 2d937d5 in elixir-tesla/tesla (opens in a new tab)related
- Fix commit db963db in elixir-tesla/tesla (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-34014 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-9m9w-gxf7-rh8m (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-48595)Record last updated .