CVE-2026-54673: electron-updater Credential Exposure Flaw

CVE-2026-54673 Overview

CVE-2026-54673 is a credential exposure vulnerability in electron-updater, the library that powers automatic updates for Electron applications. Versions prior to 9.7.0 contain a flawed HTTP redirect handler that strips only the exact lowercase authorization header when following cross-origin redirects. Other credential-bearing headers, including PRIVATE-TOKEN used by GitLab personal access tokens and mixed-case Authorization used by GitLab Bearer/OAuth flows, are forwarded intact. An attacker who controls the redirect target can harvest these credentials [CWE-200]. The maintainers fixed the issue in version 9.7.0.

Critical Impact
Cross-origin HTTP redirects can leak GitLab personal access tokens and OAuth bearer tokens to attacker-controlled servers, enabling account takeover and repository compromise.

Affected Products

electron-updater versions prior to 9.7.0
Electron applications using electron-builder with the vulnerable updater component
Deployments consuming updates from GitLab-hosted feeds using PRIVATE-TOKEN or Bearer authentication

Discovery Timeline

2026-06-30 - CVE-2026-54673 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54673

Vulnerability Analysis

The defect resides in HttpExecutor.prepareRedirectUrlOptions, which sanitizes outbound HTTP options when following a redirect. The function performs a case-sensitive string comparison against the literal authorization key. Any header whose name differs in casing or uses a vendor-specific credential scheme bypasses the strip logic. Because electron-updater retains all remaining headers when constructing the redirected request, the credentials are transmitted to the new host. This exposes the tokens to any origin the client is coerced into following, including attacker-controlled infrastructure. The impact is amplified in GitLab-backed update channels, where PRIVATE-TOKEN grants API-level access to source repositories and CI artifacts.

Root Cause

The root cause is an incomplete allowlist of sensitive header names during redirect normalization. Header names in HTTP are case-insensitive per RFC 7230, but the sanitizer treats them as case-sensitive. It also fails to recognize non-standard credential headers such as PRIVATE-TOKEN. This mismatch between the HTTP specification and the implementation is the source of the information disclosure.

Attack Vector

An attacker who can influence the update feed URL, poison DNS, or compromise an intermediate server can respond with an HTTP 3xx redirect pointing at a host they control. The electron-updater client follows the redirect and forwards the retained credential header. The attacker logs the header value and gains authenticated access to the victim's GitLab account or private update feed. User interaction is limited to launching an application that triggers an update check.

typescript

// Patch excerpt from packages/builder-util-runtime/src/index.ts
   DigestTransform,
   DownloadOptions,
   HttpError,
+  hashSensitiveValue,
   HttpExecutor,
+  isSensitiveFieldName,
   parseJson,
   RequestHeaders,
   safeGetHeader,

Source: GitHub Commit 22a7532

The patch introduces isSensitiveFieldName and hashSensitiveValue helpers that perform holistic, case-insensitive matching for credential-bearing headers and safely redact them from logs and redirected requests.

Detection Methods for CVE-2026-54673

Indicators of Compromise

Outbound HTTPS requests from Electron applications to hosts that do not match the configured update feed origin
HTTP 3xx responses from update servers redirecting to unexpected domains, followed by requests carrying Authorization or PRIVATE-TOKEN headers
Unexpected GitLab API activity, repository clones, or token usage originating from IP addresses associated with update infrastructure
Application logs containing redirect chains that terminate at non-vendor domains

Detection Strategies

Inventory installed Electron applications and their bundled electron-updater version via software composition analysis
Instrument proxies or endpoint telemetry to flag redirects from update endpoints to third-party origins
Review GitLab audit logs for personal access token use from anomalous source addresses immediately after update checks
Alert on outbound requests from packaged Electron binaries carrying PRIVATE-TOKEN headers to non-GitLab hosts

Monitoring Recommendations

Capture full URL and Host header telemetry for update-related traffic to detect cross-origin credential forwarding
Rotate and monitor GitLab personal access tokens tied to update pipelines for unexpected scopes or usage
Enable GitLab abuse and audit event streaming into a centralized SIEM for correlation with endpoint update activity

How to Mitigate CVE-2026-54673

Immediate Actions Required

Upgrade electron-updater to version 9.7.0 or later and rebuild affected Electron applications
Rotate any GitLab personal access tokens, OAuth tokens, or Bearer credentials that were configured in update feeds
Audit update feed configurations to confirm the origin uses HTTPS with certificate pinning where feasible
Redistribute patched application builds to end users through the existing update channel

Patch Information

The fix is committed in electron-builder at commit 22a7532bd01b9fb42cff7c58d599c7ad683569fe and shipped in electron-updater 9.7.0. Details are documented in GitHub Security Advisory GHSA-p2f4-r6v6-j797. The patch introduces case-insensitive, holistic sensitive header detection so that all credential-bearing headers are stripped on cross-origin redirect.

Workarounds

Restrict update feeds to hosts under vendor control and disable redirects at the CDN or reverse proxy layer
Replace PRIVATE-TOKEN and Bearer authentication with signed URL delivery for update artifacts where supported
Scope GitLab personal access tokens to the minimum required permissions and shortest viable expiration

bash

# Upgrade the vulnerable package in an electron-builder project
npm install electron-updater@^9.7.0
npm ls electron-updater