# CVE-2026-107715: Mechanize HTTP credential leakage via redirect

Source: https://junglewise.ai/threats/cve-2026-107715-mechanize-sends-credential-headers-to-another-host-after-an-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107715 · Severity: medium · CVSS 6.8 · Published 2026-10-08

Mechanize is a Ruby library that automates web browser interactions. When a web server redirects requests to another host, the library could expose authentication tokens and session credentials to the attacker's server. An attacker controlling a redirect target—through an open redirect, DNS rebinding, or network interception—can capture bearer tokens used by applications relying on Mechanize to authenticate to legitimate services.

Technologies: [mechanize (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-mechanize). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-107715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107715 being exploited in the wild.

**How severe is CVE-2026-107715?** Medium severity, with a CVSS score of 6.8, published 8 October 2026.

**Which products and versions are affected?** Mechanize before 2.14.1; mechanize (RubyGems) < 2.14.1, ECOSYSTEM:introduced=0,fixed=2.14.1.

**Is there a fix for CVE-2026-107715?** Yes. mechanize (RubyGems): upgrade to 2.14.1 or later. Until then: Set Mechanize#redirect_ok = false and handle redirects explicitly, or avoid request_headers= for credentials and pass them per-request only to hosts you intend to authenticate to. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107715 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107715?** Check whether you run Mechanize or mechanize (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mechanize (RubyGems): upgrade to 2.14.1 or later

  ```sh
  bundle update mechanize
  ```


Set Mechanize#redirect_ok = false and handle redirects explicitly, or avoid request_headers= for credentials and pass them per-request only to hosts you intend to authenticate to.

## Technical details

The vulnerability stems from two defects in lib/mechanize/http/agent.rb: (1) request_headers= bypasses the redirect credential strip entirely by copying @request_headers unconditionally onto every request without host checking, and (2) the strip list omitted Proxy-Authorization and Cookie2 headers. Credentials held in the cookie_jar and AuthStore are unaffected as they are URI-specific. An attacker controlling a redirect target can capture credentials via open redirect, DNS rebinding, or MITM after the victim's agent follows the redirect.

## Affected products

- Mechanize Mechanize before 2.14.1

## Identifiers

- CVE-2026-107715
- GHSA-2mwr-xjcg-37j7

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Mechanize credential leak via meta refresh redirect](https://junglewise.ai/threats/cve-2026-107399-mechanize-sends-credential-headers-to-another-origin-after-a)
- [Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect](https://junglewise.ai/threats/cve-2022-31033-mechanize-before-v2-8-5-vulnerable-to-authorization-header-leak)
- [Command Injection Vulnerability in Mechanize](https://junglewise.ai/threats/cve-2021-21289-command-injection-vulnerability-in-mechanize)