# CVE-2021-41125: Scrapy HTTP authentication credentials potentially leaked to target websites

Source: https://junglewise.ai/threats/cve-2021-41125-scrapy-http-authentication-credentials-potentially-leaked-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-10-06  
License: CC BY 4.0 with a link back

CVE-2021-41125 · Severity: low · CVSS 3.1 · Published 2021-10-06

Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target. This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects. Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead. If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the `w3lib.http.basic_auth_header` function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using `HttpAuthMiddleware`.

Technologies: [scrapy (PyPI)](https://junglewise.ai/threats/technologies/scrapy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-41125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-41125 being exploited in the wild.

**How severe is CVE-2021-41125?** Low severity, with a CVSS score of 3.1, published 6 October 2021.

**Which products and versions are affected?** scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.1, GIT:introduced=0,fixed=b01d69a1bf48060daec8f751368622352d8b85a6|ECOSYSTEM:introduced=0,fixed=1.8.1,introduced=2.0.0,fixed=2.5.1.

**Is there a fix for CVE-2021-41125?** Yes. scrapy (PyPI): upgrade to 1.8.1, 2.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-41125?** Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- scrapy (PyPI): upgrade to 1.8.1, 2.5.1 or later

  ```sh
  pip install "scrapy>=2.5.1"
  ```


## Affected products

- scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.1, GIT:introduced=0,fixed=b01d69a1bf48060daec8f751368622352d8b85a6|ECOSYSTEM:introduced=0,fixed=1.8.1,introduced=2.0.0,fixed=2.5.1

## Identifiers

- CVE-2021-41125
- GHSA-jwqp-28gf-p498
- PYSEC-2021-363

## Related threats

- [Scrapy arbitrary code execution via Referrer-Policy header](https://junglewise.ai/threats/cve-2026-105782-scrapy-arbitrary-module-import-via-referrer-policy-header-in)
- [Scrapy S3DownloadHandler cleartext transmission of AWS credentials](https://junglewise.ai/threats/cve-2026-84366-scrapy-s3downloadhandler-cleartext-transmission-of-aws)
- [PYSEC-2026-2401 - Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation](https://junglewise.ai/threats/cve-2025-6176-scrapy-denial-of-service-via-brotli-decompression-bomb)
- [PYSEC-2026-1907 - Scrapy decompression bomb vulnerability](https://junglewise.ai/threats/cve-2024-3572-scrapy-decompression-bomb-vulnerability)
- [PYSEC-2026-1908 - Scrapy authorization header leakage on cross-domain redirect](https://junglewise.ai/threats/cve-2024-3574-scrapy-authorization-header-leakage-on-cross-domain-redirect)