Is CVE-2026-48595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48595 being exploited in the wild.

How severe is CVE-2026-48595?

High severity, with a CVSS score of 8.2, published 2 June 2026.

Which products and versions are affected?

elixir-tesla tesla >= 0.6.0, < 1.18.3.

Is there a fix for CVE-2026-48595?

A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48595 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48595?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48595: Elixir Tesla credential leakage in FollowRedirects middleware

Q: Is there a fix for CVE-2026-48595?

A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48595 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48595?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48595 · Severity: high · CVSS 8.2 · Published 2026-06-02

Tesla, a popular HTTP client library for Elixir, contains a flaw where sensitive login credentials (like bearer tokens) can be accidentally sent to untrusted websites. When the library follows a link that redirects to a different website, it is supposed to remove security headers, but it fails to do so if the header name uses standard capitalization (e.g., 'Authorization' instead of 'authorization'). This could allow an attacker to steal user credentials by redirecting a victim's request to a server they control.

Quick answers

Is CVE-2026-48595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48595 being exploited in the wild.
How severe is CVE-2026-48595?: High severity, with a CVSS score of 8.2, published 2 June 2026.
Which products and versions are affected?: elixir-tesla tesla >= 0.6.0, < 1.18.3.
Is there a fix for CVE-2026-48595?: A patch was published on 1.18.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48595 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48595?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `Tesla.Middleware.FollowRedirects` component performs case-sensitive filtering against a lowercase list of sensitive headers (`["authorization", "host"]`). Because Tesla preserves the original casing of headers provided by the caller, a header defined as `"Authorization"` (canonical casing) bypasses the `k not in @filter_headers` check. An attacker who controls a redirect destination (via a 3xx response) can capture these forwarded credentials. The vulnerability is present in versions 0.6.0 through 1.18.2 and is fixed in 1.18.3 by implementing case-insensitive header comparison.

Affected products

elixir-tesla tesla >= 0.6.0, < 1.18.3

Identifiers

CVE-2026-48595
GHSA-9m9w-gxf7-rh8m

Timeline

2026-06-02: disclosed: Initial disclosure and NVD publication
2026-07-10: advisory: GitHub Advisory published
1.18.3: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.