CVE-2026-54171: Excon Information Disclosure Vulnerability

CVE-2026-54171 Overview

CVE-2026-54171 is an information disclosure vulnerability in Excon, a Ruby HTTP 1.1 client library. The RedirectFollower middleware fails to strip sensitive headers when following HTTP redirects to a new target host. Applications that pass authentication tokens, cookies, or other confidential headers in initial requests can inadvertently leak this data to unintended servers. The issue is classified as [CWE-201: Insertion of Sensitive Information Into Sent Data]. Excon released version 1.5.0 to remediate the flaw by expanding the list of headers stripped during redirect handling.

Critical Impact
Applications using Excon's RedirectFollower middleware can leak authorization tokens, cookies, and other sensitive headers to third-party servers via HTTP redirect chains.

Affected Products

Excon Ruby HTTP client library versions prior to 1.5.0
Ruby applications using the Excon::Middleware::RedirectFollower middleware
Downstream libraries and gems depending on vulnerable Excon versions

Discovery Timeline

2026-07-17 - CVE-2026-54171 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54171

Vulnerability Analysis

Excon provides middleware chains for HTTP request and response processing. The RedirectFollower middleware transparently follows HTTP 3xx redirects by re-issuing the request to the target specified in the Location header. Prior to version 1.5.0, this middleware did not strip a sufficient set of sensitive headers before dispatching the follow-up request. The middleware also lacked a mechanism for callers to supply a custom list of headers requiring redaction. When a redirect points to a different host, headers such as Authorization, Cookie, or custom authentication headers can be forwarded verbatim to the new destination.

Root Cause

The root cause is incomplete header sanitization in the redirect logic. The prior implementation redacted a narrow set of headers and provided no extensibility, so bearer tokens and session cookies attached to the original request persisted across cross-origin redirects. The fix in pull request #901 expands header redaction and removes the separate CaptureCookies middleware that could reintroduce cookies during redirects.

Attack Vector

Exploitation requires that a Ruby application using Excon issue an outbound request to an attacker-controlled or attacker-influenced endpoint. That endpoint returns a redirect to a host under the attacker's control. Excon then re-sends the original sensitive headers to the attacker's server. This scenario is common in webhook processors, URL preview services, SSRF-adjacent workflows, or any code path where target URLs derive from untrusted input. User interaction, such as submitting a crafted URL, is typically required.

ruby

# Patch excerpt from lib/excon.rb (commit ea89a35)
 require 'excon/response'
 require 'excon/middlewares/escape_path'
 require 'excon/middlewares/redirect_follower'
-require 'excon/middlewares/capture_cookies'
 require 'excon/pretty_printer'
 require 'excon/socket'
 require 'excon/ssl_socket'

Source: GitHub Commit ea89a35

The patch removes the capture_cookies middleware from the default load path. This middleware previously extracted Set-Cookie values from responses and reattached them as Cookie headers on subsequent requests, including redirects, which contributed to cross-host cookie leakage.

Detection Methods for CVE-2026-54171

Indicators of Compromise

Outbound HTTP requests from Ruby application servers containing Authorization or Cookie headers directed at unexpected external domains.
Application logs showing redirect chains where the final host differs from the originally requested host.
Requests to attacker-controlled hosts that include bearer tokens or session identifiers issued by internal services.

Detection Strategies

Inventory Ruby dependency manifests (Gemfile.lock) across the fleet and flag any Excon version below 1.5.0.
Instrument HTTP client wrappers to log and alert when redirects cross origin boundaries while carrying authentication headers.
Correlate egress proxy logs with allow-listed destinations to surface anomalous outbound traffic from application services.

Monitoring Recommendations

Monitor build pipelines and software composition analysis (SCA) output for Excon versions prior to 1.5.0.
Alert on outbound traffic from application tiers to previously unseen domains, particularly when originating from HTTP client libraries.
Track dependency update pull requests to confirm timely rollout of the excon 1.5.0 upgrade.

How to Mitigate CVE-2026-54171

Immediate Actions Required

Upgrade the excon gem to version 1.5.0 or later across all Ruby services and container images.
Audit application code that follows redirects to untrusted URLs and confirm no residual reliance on the removed CaptureCookies middleware.
Rotate any bearer tokens, API keys, or session cookies that may have transited redirect chains to third-party hosts.

Patch Information

Upgrade to Excon 1.5.0, which expands the set of sensitive headers stripped by RedirectFollower and removes the default CaptureCookies middleware. Review the GitHub Security Advisory GHSA-48rx-c7pg-q66r and Pull Request #901 for full change details.

Workarounds

Disable the RedirectFollower middleware and handle redirects explicitly in application code, validating the target host before re-issuing requests.
Strip Authorization, Cookie, and custom auth headers manually before invoking Excon on user-supplied URLs.
Restrict outbound HTTP egress from application services to an allow-list of known-good destinations via an egress proxy.

bash

# Update Excon to the patched version
bundle update excon --conservative

# Verify the installed version
bundle info excon | grep -i version
# Expected: * version: 1.5.0 (or higher)