Is CVE-2026-69212 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69212 being exploited in the wild.

How severe is CVE-2026-69212?

Medium severity, with a CVSS score of 5.9, published 15 September 2026.

Which products and versions are affected?

Http4s prior to 0.23.35 and 1.0.0-M47.

Is there a fix for CVE-2026-69212?

A patch was published on 2026-07-06: Fix released in versions 0.23.35 and 1.0.0-M47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69212 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-69212?

Check whether you run Http4s at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69212: Http4s FollowRedirect credential leak on scheme downgrade

CVE-2026-69212 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Http4s is a Scala-based HTTP client library widely used to build microservices and API clients. The FollowRedirect middleware, which automatically follows HTTP redirects, fails to strip authentication and session cookies when redirects downgrade from HTTPS to HTTP on the same domain. An attacker who can force a redirect and monitor network traffic can capture these credentials in plaintext, potentially compromising API keys, session tokens, and user accounts.

Technologies: Http4s. Vendors: Http4s.

Quick answers

Is CVE-2026-69212 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69212 being exploited in the wild.
How severe is CVE-2026-69212?: Medium severity, with a CVSS score of 5.9, published 15 September 2026.
Which products and versions are affected?: Http4s prior to 0.23.35 and 1.0.0-M47.
Is there a fix for CVE-2026-69212?: A patch was published on 2026-07-06: Fix released in versions 0.23.35 and 1.0.0-M47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69212 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-69212?: Check whether you run Http4s at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The FollowRedirect middleware in Http4s compares HTTP authority (hostname + port) between pre-redirect and post-redirect URLs to determine whether to strip sensitive headers like Authorization and Cookie. However, the comparison logic excludes the URI scheme (protocol), meaning a same-authority redirect from https://example.com to http://example.com is incorrectly treated as safe. Credentials are preserved and transmitted over plaintext HTTP. The vulnerability requires network-adjacent attacker position to observe traffic (e.g., compromised network, DNS hijacking, or MITM on redirect), or ability to induce the downgrade. Applications using FollowRedirect for any outbound HTTP client calls are affected. Fixes are available in versions 0.23.35 and 1.0.0-M47.

Affected products

Http4s Http4s prior to 0.23.35 and 1.0.0-M47

Timeline

2026-09-15: disclosed
2026-07-06: patched: Fix released in versions 0.23.35 and 1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.