Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-59180Apprise forwards configured auth headers across cross-origin HTTP redirects

Low 3.1

In plain English

A low-severity information exposure in apprise from caronc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12appriseno fix listedDEBIAN-CVE-2026-59180
Debian:13appriseno fix listedDEBIAN-CVE-2026-59180
Debian:14apprise1.11.0-1DEBIAN-CVE-2026-59180
PyPIapprise1.11.0PYSEC-2026-4200
PyPIapprise1.11.0GHSA-856c-92hv-3vxx
Ubuntu:24.04:LTSappriseno fix listedUBUNTU-CVE-2026-59180
Ubuntu:26.04:LTSappriseno fix listedUBUNTU-CVE-2026-59180

Affected products (as reported)

VendorProductVersions
caronc apprise < 1.11.0

Weakness: CWE-200, CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References