Is CVE-2026-107715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107715 being exploited in the wild.

How severe is CVE-2026-107715?

Medium severity, with a CVSS score of 6.8, published 8 October 2026.

Which products and versions are affected?

Mechanize before 2.14.1; mechanize (RubyGems) < 2.14.1, ECOSYSTEM:introduced=0,fixed=2.14.1.

How is CVE-2026-107715 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107715?

Check whether you run Mechanize or mechanize (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107715: Mechanize HTTP credential leakage via redirect

Q: Is there a fix for CVE-2026-107715?

Yes. mechanize (RubyGems): upgrade to 2.14.1 or later. Until then: Set Mechanize#redirect_ok = false and handle redirects explicitly, or avoid request_headers= for credentials and pass them per-request only to hosts you intend to authenticate to. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107715 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107715?

Check whether you run Mechanize or mechanize (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107715 · Severity: medium · CVSS 6.8 · Published 2026-10-08

Mechanize is a Ruby library that automates web browser interactions. When a web server redirects requests to another host, the library could expose authentication tokens and session credentials to the attacker's server. An attacker controlling a redirect target—through an open redirect, DNS rebinding, or network interception—can capture bearer tokens used by applications relying on Mechanize to authenticate to legitimate services.

Technologies: mechanize (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-107715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107715 being exploited in the wild.
How severe is CVE-2026-107715?: Medium severity, with a CVSS score of 6.8, published 8 October 2026.
Which products and versions are affected?: Mechanize before 2.14.1; mechanize (RubyGems) < 2.14.1, ECOSYSTEM:introduced=0,fixed=2.14.1.
Is there a fix for CVE-2026-107715?: Yes. mechanize (RubyGems): upgrade to 2.14.1 or later. Until then: Set Mechanize#redirect_ok = false and handle redirects explicitly, or avoid request_headers= for credentials and pass them per-request only to hosts you intend to authenticate to. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107715 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107715?: Check whether you run Mechanize or mechanize (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mechanize (RubyGems): upgrade to 2.14.1 or later
```
bundle update mechanize
```

Set Mechanize#redirect_ok = false and handle redirects explicitly, or avoid request_headers= for credentials and pass them per-request only to hosts you intend to authenticate to.

Technical details

The vulnerability stems from two defects in lib/mechanize/http/agent.rb: (1) request_headers= bypasses the redirect credential strip entirely by copying @request_headers unconditionally onto every request without host checking, and (2) the strip list omitted Proxy-Authorization and Cookie2 headers. Credentials held in the cookie_jar and AuthStore are unaffected as they are URI-specific. An attacker controlling a redirect target can capture credentials via open redirect, DNS rebinding, or MITM after the victim's agent follows the redirect.

Affected products

Mechanize Mechanize before 2.14.1

Identifiers

CVE-2026-107715
GHSA-2mwr-xjcg-37j7

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.