CVE-2026-12547 Overview
CVE-2026-12547 is an information disclosure vulnerability in SoupAuthManager, the authentication caching component of the libsoup HTTP client library used by GNOME applications. The library caches proxy authentication credentials without binding them to the proxy authority (host and port). When the proxy configuration changes through system settings or Web Proxy Auto-Discovery (WPAD), the cached Proxy-Authorization header is transmitted to the new proxy. This behavior leaks credentials intended for the previous proxy to an unrelated destination. The issue is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data.
Critical Impact
Cached proxy credentials are transmitted to any subsequent proxy after configuration changes, enabling an attacker who controls proxy selection (for example, via a malicious WPAD response) to harvest credentials belonging to a different proxy.
Affected Products
- GNOME libsoup HTTP client library (SoupAuthManager component)
- Applications linking against affected libsoup versions on Linux distributions
- Red Hat Enterprise Linux packages consuming libsoup (see Red Hat CVE-2026-12547 Advisory)
Discovery Timeline
- 2026-07-21 - CVE-2026-12547 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-12547
Vulnerability Analysis
SoupAuthManager maintains an in-memory cache of authentication state so that clients do not need to re-negotiate credentials for every request. For proxy authentication, this cache is keyed in a way that does not include the proxy authority. The cache lookup treats prior credentials as valid for any proxy the client subsequently connects to.
When a client rotates proxies during a session, libsoup reuses the cached Proxy-Authorization header. The new proxy receives credentials that were provisioned exclusively for the previous proxy. An operator of the new proxy can observe the header, decode Basic authentication material, or capture Digest challenges and responses.
Exploitation requires user interaction and pre-existing privileges to influence proxy configuration. The scope change reflects that credentials cross a trust boundary from one proxy operator to another.
Root Cause
The cache key for proxy credentials in SoupAuthManager omits the host:port authority of the proxy. Authentication material is treated as a session-wide property rather than a per-proxy secret. Any code path that changes the active proxy after the cache is populated causes the mismatched credentials to be sent on the next request.
Attack Vector
An attacker who can influence proxy selection triggers the leak. Common paths include a rogue WPAD server on the local network, a malicious PAC file, or manipulation of system proxy settings by a lower-privileged process. The victim application then performs an HTTP request through the attacker-controlled proxy, which receives the Proxy-Authorization header issued for the previous, trusted proxy.
The vulnerability does not permit arbitrary code execution and does not modify data. It exclusively discloses credential material. See the GNOME Work Item #506 and Red Hat Bug Report #2489994 for upstream discussion.
Detection Methods for CVE-2026-12547
Indicators of Compromise
- Outbound HTTP CONNECT or GET requests containing Proxy-Authorization headers directed to proxies not present in the organization's approved proxy inventory.
- Unexpected WPAD (wpad.dat) or PAC file downloads from untrusted network segments preceding proxy configuration changes.
- libsoup-based processes (for example, gnome-shell, evolution, epiphany) initiating connections to unfamiliar proxy hosts.
Detection Strategies
- Inspect egress traffic at the network perimeter for Proxy-Authorization headers whose destination proxy does not match the credential owner recorded in identity systems.
- Correlate proxy configuration change events (GSettings, NetworkManager, WPAD DHCP option 252) with subsequent outbound HTTP authentication attempts from the same host.
- Alert on DHCP or DNS responses that introduce WPAD hosts on segments where WPAD is not sanctioned.
Monitoring Recommendations
- Log proxy configuration changes and PAC file retrievals from endpoints running GNOME applications.
- Monitor process telemetry for libsoup clients establishing connections to proxies outside a managed allowlist.
- Track authentication failures on legitimate proxies that follow configuration changes, which can indicate credentials were sent elsewhere first.
How to Mitigate CVE-2026-12547
Immediate Actions Required
- Apply the libsoup update supplied by your distribution vendor as soon as it is available. Track availability through the Red Hat CVE-2026-12547 Advisory.
- Disable WPAD on endpoints and networks where automatic proxy discovery is not required.
- Restrict local user ability to modify system proxy settings through policy controls.
Patch Information
Upstream tracking is available in GNOME Work Item #506. Distribution-specific fixes will scope the proxy authentication cache key to include the proxy authority, ensuring cached Proxy-Authorization headers are only reused when the target proxy matches the one that issued the credentials. Consult the Red Hat Bug Report #2489994 for package status.
Workarounds
- Configure a static proxy for libsoup-based applications and prevent runtime changes during the session lifetime.
- Disable PAC and WPAD-based proxy resolution in GNOME network settings and NetworkManager profiles.
- Restart affected applications after any proxy configuration change to flush the in-memory authentication cache before further requests are issued.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
