Executive brief
libsoup is a networking library used by many Linux applications to handle web requests. A flaw in how it manages proxy server authentication allows sensitive login credentials intended for one proxy server to be accidentally sent to a different proxy server if the system's network configuration changes. This could allow an attacker who controls a secondary proxy server to capture enterprise credentials when a user switches networks or updates their settings.
Technical details
A vulnerability exists in libsoup's SoupAuthManager where proxy authentication state is cached globally rather than being scoped to a specific proxy authority (host:port). When a session's proxy configuration is updated (e.g., via system settings or WPAD) after an initial authentication has occurred, the library incorrectly attaches the cached 'Proxy-Authorization' header from the previous proxy to requests sent to the new proxy. An attacker who can influence proxy settings or provide a malicious proxy can capture these leaked credentials. The issue is tracked in libsoup's internal work items and affects versions used in Red Hat Enterprise Linux 10 and other GNOME-based environments.
Affected products
- Red Hat libsoup3 Red Hat Enterprise Linux 10
- GNOME libsoup
Timeline
- 2026-01-25: disclosed: Vulnerability reported via YesWeHack
- 2026-06-17: other: Bug report opened in Red Hat Bugzilla
- 2026-07-21: advisory: CVE published to NVD