Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107399Mechanize sends credential headers to another origin after a meta refresh

Medium 6.8

In plain English

A medium-severity information exposure in mechanize from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ruby-mechanize	no fix listed	DEBIAN-CVE-2026-107399
Debian:13	ruby-mechanize	no fix listed	DEBIAN-CVE-2026-107399
Debian:14	ruby-mechanize	2.14.1-1	DEBIAN-CVE-2026-107399
RubyGems	mechanize	2.14.1	GHSA-c6rp-p8xm-4q9f
Ubuntu:22.04:LTS	ruby-mechanize	no fix listed	UBUNTU-CVE-2026-107399
Ubuntu:24.04:LTS	ruby-mechanize	no fix listed	UBUNTU-CVE-2026-107399
Ubuntu:26.04:LTS	ruby-mechanize	no fix listed	UBUNTU-CVE-2026-107399
Ubuntu:26.10	ruby-mechanize	no fix listed	UBUNTU-CVE-2026-107399

Affected products (as reported)

Vendor	Product	Versions
sparklemotion	mechanize	< 2.15.0

Weakness: CWE-200, CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676 x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3 x_refsource_MISC
https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1 x_refsource_MISC