Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.3, published 24 July 2026.

Which products and versions are affected?

hubuum_client (crates.io) >= 0.0.1, < 0.6.1.

Is there a fix for This vulnerability?

A patch was published on 2026-07-24: Fixed in version 0.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run hubuum_client (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Hubuum hubuum_client sensitive information leak via redirects

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-24: Fixed in version 0.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run hubuum_client (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.3 · Published 2026-07-24

The Hubuum Rust client library contains a flaw where sensitive login credentials (authentication headers) can be accidentally sent to unintended locations on the same server. If a server or an attacker can trigger a redirect, the library may follow that redirect and include the user's private security token in the new request. This could allow an unauthorized party to capture credentials if they control a different application hosted on the same domain.

Technologies: hubuum_client (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.3, published 24 July 2026.
Which products and versions are affected?: hubuum_client (crates.io) >= 0.0.1, < 0.6.1.
Is there a fix for This vulnerability?: A patch was published on 2026-07-24: Fixed in version 0.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run hubuum_client (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Hubuum Rust client library (hubuum_client) utilizes the reqwest HTTP library with its default redirect policy. While the library's BaseUrl configuration constrains the initial request, reqwest's default behavior retains sensitive headers (like the bearer Authorization header) when a redirect occurs within the same scheme, host, and port. An attacker or a compromised server capable of influencing a 3xx redirect response can redirect a client request to a different path on the same origin, causing the client to leak the authentication token to that path. This is classified as CWE-200 (Exposure of Sensitive Information). The issue is fixed in version 0.6.1 by disabling automatic redirects in the built-in HTTP clients.

Affected products

Hubuum hubuum_client >= 0.0.1, < 0.6.1

Timeline

2026-07-23: disclosed
2026-07-24: advisory
2026-07-24: patched: Fixed in version 0.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.