# CVE-2026-67435: Linuxfabrik linuxfabrik-lib sensitive header exposure in fetch redirect

Source: https://junglewise.ai/threats/cve-2026-67435-linuxfabrik-linuxfabrik-lib-sensitive-header-exposure-in-fetch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67435 · Severity: medium · CVSS 4 · Published 2026-07-29

A vulnerability in the Linuxfabrik monitoring library could allow sensitive credentials to be leaked to unauthorized third-party servers. When the library makes an authenticated request to a server that redirects to a different website, it may incorrectly forward secret tokens (like API keys or session tokens) to that new destination. This could allow an attacker to steal credentials and gain unauthorized access to monitored systems or data.

Technologies: [linuxfabrik-lib (PyPI)](https://junglewise.ai/threats/technologies/linuxfabrik-lib). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-67435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67435 being exploited in the wild.

**How severe is CVE-2026-67435?** Medium severity, with a CVSS score of 4, published 29 July 2026.

**Which products and versions are affected?** linuxfabrik-lib (PyPI) < 6.0.0, ECOSYSTEM:introduced=0,fixed=6.0.0.

**Is there a fix for CVE-2026-67435?** Yes. linuxfabrik-lib (PyPI): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67435 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67435?** Check whether you run linuxfabrik-lib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- linuxfabrik-lib (PyPI): upgrade to 6.0.0 or later

  ```sh
  pip install "linuxfabrik-lib>=6.0.0"
  ```


## Technical details

The `lib.url.fetch()` function in linuxfabrik-lib fails to strip non-standard authentication headers when following HTTP redirects to a different origin. While standard headers like `Authorization` and `Cookie` were stripped by the underlying `httpx` library, other caller-supplied headers (e.g., Redfish's `X-Auth-Token`) remained attached to the redirected request. An attacker-controlled or compromised server can respond to an authenticated request with a 3xx redirect to a malicious host, capturing the sensitive headers. This issue is fixed in version 6.0.0, which now drops all non-transport headers on cross-origin redirects.

## Affected products

- Linuxfabrik linuxfabrik-lib < 6.0.0

## Identifiers

- CVE-2026-67435
- GHSA-4jc5-g844-4x33
- PYSEC-2026-3578

## Timeline

- 2026-07-07: disclosed: Advisory published by Linuxfabrik
- 2026-07-07: patched: Fixed in version 6.0.0 (commit 6573ff9)
- 2026-07-30: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Pig-Tail](https://api.github.com/users/Pig-Tail)
- [https://github.com/Pig-Tail](https://github.com/Pig-Tail)
- [https://api.github.com/users/Pig-Tail/gists%7B/gist_id%7D](https://api.github.com/users/Pig-Tail/gists%7B/gist_id%7D)
- [https://api.github.com/users/Pig-Tail/repos](https://api.github.com/users/Pig-Tail/repos)
- [https://avatars.githubusercontent.com/u/15832659?v=4](https://avatars.githubusercontent.com/u/15832659?v=4)
- [https://api.github.com/users/Pig-Tail/events%7B/privacy%7D](https://api.github.com/users/Pig-Tail/events%7B/privacy%7D)

## Related threats

- [Linuxfabrik monitoring-plugins arbitrary root file read via --test argument](https://junglewise.ai/threats/cve-2026-73974-linuxfabrik-monitoring-plugins-arbitrary-root-file-read-via-test)
- [Linuxfabrik Monitoring Plugins insecure temporary file creation in linuxfabrik-lib](https://junglewise.ai/threats/cve-2026-53759-linuxfabrik-monitoring-plugins-insecure-temporary-file-creation)
- [Linuxfabrik Monitoring Plugins OS command injection in shell_exec](https://junglewise.ai/threats/cve-2026-55426-linuxfabrik-monitoring-plugins-os-command-injection-in-shell-exec)
- [Linuxfabrik Monitoring Plugins privilege escalation in Debian.sudoers](https://junglewise.ai/threats/cve-2026-52817-linuxfabrik-monitoring-plugins-privilege-escalation-in-debian)