CVE-2026-107715

🗓️ 13 Oct 2026 00:00:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 2 Views

Mechanize sends caller-supplied headers to a different host after an HTTP redirect.

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2026-107715	9 Oct 202610:30	–	circl
CVE	CVE-2026-107715	8 Oct 202621:27	–	cve
Cvelist	CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect	8 Oct 202621:27	–	cvelist
Debian CVE	CVE-2026-107715	8 Oct 202621:27	–	debiancve
EUVD	EUVD-2026-95321	8 Oct 202621:27	–	euvd
Github Security Blog	Mechanize sends credential headers to another host after an HTTP redirect	8 Oct 202622:09	–	github
Mend	CVE-2026-107715	8 Oct 202621:27	–	mend
NVD	CVE-2026-107715	8 Oct 202622:17	–	nvd
OSV	DEBIAN-CVE-2026-107715	8 Oct 202622:17	–	osv
OSV	GHSA-2MWR-XJCG-37J7 Mechanize sends credential headers to another host after an HTTP redirect	8 Oct 202622:09	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	16.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb
Ubuntu	18.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb
Ubuntu	20.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb
Ubuntu	22.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb
Ubuntu	24.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb
Ubuntu	26.04	all	ruby-mechanize	0	ruby-mechanize_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f
github	www.github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745
github	www.github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95
github	www.github.com/sparklemotion/mechanize/pull/676
github	www.github.com/sparklemotion/mechanize/releases/tag/v2.14.1
github	www.github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7

13 Oct 2026 20:49Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.8

EPSS0.00395

SSVC

Mechanize HTTP redirect header leakage bearer tokens session cookies