CVE-2026-66339: libsoup Information Disclosure Flaw

CVE-2026-66339 Overview

CVE-2026-66339 is an information disclosure vulnerability in libsoup, the HTTP client/server library widely used across GNOME and other Linux applications. After establishing an HTTP CONNECT tunnel through a proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. The destination server can capture the proxy credentials, exposing them to any party controlling or observing the endpoint. The flaw is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
A malicious or compromised destination server can harvest valid proxy credentials from clients using libsoup, enabling further access to internal proxy infrastructure.

Affected Products

libsoup HTTP client library
Red Hat Enterprise Linux distributions shipping libsoup (see Red Hat CVE-2026-66339 Advisory)
Applications that route HTTPS traffic through authenticated HTTP proxies using libsoup

Discovery Timeline

2026-07-24 - CVE-2026-66339 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66339

Vulnerability Analysis

The HTTP CONNECT method establishes a TCP tunnel through a proxy so a client can negotiate TLS directly with the destination server. Proxy authentication happens during the CONNECT handshake using the Proxy-Authorization header. Once the tunnel is established and TLS is negotiated, requests sent over the tunnel travel end-to-end between client and destination, and proxy-specific headers must not be included.

libsoup fails to strip the Proxy-Authorization header from HTTPS requests that traverse an already-established CONNECT tunnel. The credential, typically Basic or Digest, is delivered inside the TLS session directly to the destination server. The destination server can log, replay, or abuse the credential to authenticate against the proxy.

Root Cause

The defect lives in libsoup's request-header assembly logic for tunneled HTTPS traffic. Headers intended only for the proxy hop are not scoped to the CONNECT request and are re-emitted on the tunneled application requests. This violates [RFC 7235] guidance requiring hop-by-hop authentication headers to remain confined to the proxy connection.

Attack Vector

Exploitation requires a user or application to send HTTPS traffic through an authenticated proxy to an attacker-controlled or attacker-observable destination. User interaction is required to trigger the request, as reflected in the CVSS vector component UI:R. No privileges are needed on the target system. The attacker recovers the proxy credential from the received request headers and can then authenticate to the proxy as the victim.

See the Red Hat Bugzilla Report #2506951 for triage details.

Detection Methods for CVE-2026-66339

Indicators of Compromise

Outbound HTTPS requests from libsoup-based clients containing a Proxy-Authorization header at the destination server.
Proxy logs showing successful authentications from IP addresses that never received a CONNECT from that user session.
Unexpected reuse of proxy Basic or Digest credentials from external networks.

Detection Strategies

Inspect proxy egress traffic captures for Proxy-Authorization headers appearing inside CONNECT-tunneled sessions where TLS termination is available.
Audit installed libsoup package versions across Linux fleets and correlate with vendor advisory fixed versions.
Alert on proxy authentication events originating from source addresses outside the expected client subnet.

Monitoring Recommendations

Enable verbose authentication logging on forward proxies and forward events to a centralized analytics platform for correlation.
Rotate proxy credentials on a defined schedule and monitor for reuse anomalies.
Track libsoup package inventory across endpoints and servers to identify unpatched hosts.

How to Mitigate CVE-2026-66339

Immediate Actions Required

Update libsoup to the patched version distributed by your Linux vendor as soon as it is available.
Rotate any proxy credentials that may have been sent through libsoup-based clients to untrusted destinations.
Restrict outbound HTTPS from workstations to approved destinations while patches roll out.

Patch Information

Red Hat is tracking the fix through Bugzilla #2506951 and the Red Hat CVE-2026-66339 Advisory. Apply distribution updates for libsoup and any packages that statically link against it. Restart applications after upgrade so they load the patched library.

Workarounds

Configure clients to use unauthenticated proxies where policy permits, removing the credential from the request path entirely.
Terminate HTTPS at an internal inspecting proxy so external destinations never observe the tunneled headers.
Disable libsoup-based HTTP clients from using proxies for external destinations until patched.

bash

# Configuration example: verify installed libsoup version and update
rpm -q libsoup libsoup3
dnf update libsoup libsoup3
# Restart services that load libsoup
systemctl restart gnome-online-accounts evolution-source-registry