Executive brief
A vulnerability in the Linuxfabrik monitoring library could allow sensitive credentials to be leaked to unauthorized third-party servers. When the library makes an authenticated request to a server that redirects to a different website, it may incorrectly forward secret tokens (like API keys or session tokens) to that new destination. This could allow an attacker to steal credentials and gain unauthorized access to monitored systems or data.
Technical details
The `lib.url.fetch()` function in linuxfabrik-lib fails to strip non-standard authentication headers when following HTTP redirects to a different origin. While standard headers like `Authorization` and `Cookie` were stripped by the underlying `httpx` library, other caller-supplied headers (e.g., Redfish's `X-Auth-Token`) remained attached to the redirected request. An attacker-controlled or compromised server can respond to an authenticated request with a 3xx redirect to a malicious host, capturing the sensitive headers. This issue is fixed in version 6.0.0, which now drops all non-transport headers on cross-origin redirects.
Affected products
- Linuxfabrik linuxfabrik-lib < 6.0.0
Timeline
- 2026-07-07: disclosed: Advisory published by Linuxfabrik
- 2026-07-07: patched: Fixed in version 6.0.0 (commit 6573ff9)
- 2026-07-30: advisory: GitHub Advisory published