---
schema_version: '1.0'
id: security-20260711-f7ce82
url: https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
url_hash: f7ce8245bccd32c275fdd96fb1894d1200f934ae708ee090dfe9d70b8ace1d16
canonical_url: https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-44431
- GHSA-qccp-gfcp-xxvc
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- urllib3
- PyPI
lang: en
published_at: '2026-05-11T14:51:20Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: 97044383b606c53e756b58a90e7653c2d2c8e9c8fd2bae3c952c56f754de92c3
license_note: full
summary: 'urllib3: Sensitive headers forwarded across origins in proxied low-level
  redirects'
summary_source: rss
summary_en: 'urllib3: Sensitive headers forwarded across origins in proxied low-level
  redirects'
entities: []
key_facts: []
related: []
related_auto: []
title: 'CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied
  low-level redirects'
---

# CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

## TL;DR
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

## Key Points
- cve / CVE-2026-44431 / GHSA-qccp-gfcp-xxvc / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N / urllib3 / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
**Advisory:** GHSA-qccp-gfcp-xxvc (CVE-2026-44431)

**Affected (your watchlist):**
- `PyPI:urllib3` 2.6.3 → fixed in 2.7.0 [docker/docker-llmwiki]

**Details:**
### Impact

When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.

However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.

### Affected usage

Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.

### Remediation

Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.

If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.

**References:**
- https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
- https://nvd.nist.gov/vuln/detail/CVE-2026-44431
- https://github.com/urllib3/urllib3

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc_

## Source
元記事: [CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects](https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc) — published 2026-05-11T14:51:20Z