# Guzzle Proxy-Authorization header disclosure to origin servers

Source: https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2026-08-01

Guzzle, a popular PHP library for making web requests, contains a flaw where sensitive proxy login credentials can be accidentally sent to the wrong destination. If an application is configured to use a proxy, these credentials may be leaked to the final website being visited or to an attacker who redirects the connection. This could allow an unauthorized party to capture proxy passwords and gain access to restricted network resources.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 1 August 2026.

**Which products and versions are affected?** Guzzle < 7.14.2; guzzlehttp/guzzle (Packagist) < 7.14.2.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Guzzle versions prior to 7.14.2 fail to properly isolate the Proxy-Authorization header when using cURL or stream handlers. The library's internal logic for migrating headers to the proxy-specific channel (CURLOPT_PROXYHEADER) relies on a prediction of the request route rather than the actual path taken by libcurl. Consequently, if a request is redirected from a proxied hop to a direct connection, or if SOCKS proxies are used, the sensitive header remains in the standard origin header list. An attacker controlling an origin server or a redirect destination can capture these credentials from server logs. The issue is resolved in version 7.14.2 by ensuring headers are stripped or correctly isolated regardless of the predicted route.

## Affected products

- guzzlehttp guzzle < 7.14.2

## Timeline

- 2026-07-14: advisory: Original advisory GHSA-94pj-82f3-465w published
- 2026-08-01: disclosed: CVE-2026-67339 published
- 2026-08-04: other: Duplicate advisory GHSA-32rq-jhr7-m3hh withdrawn

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w](https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w)
- [https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure](https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)