CVE-2026-67435: linuxfabrik-lib Information Disclosure

CVE-2026-67435 Overview

CVE-2026-67435 affects linuxfabrik-lib, a Python library providing modules for database access, caching, shell execution, and API integrations. The lib.url.fetch() function followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie. A malicious redirect-capable server could therefore receive sensitive headers such as X-Auth-Token from authenticated monitoring requests. The issue is fixed in version 6.0.0. This is an information exposure flaw classified under [CWE-200].

Critical Impact
Attackers controlling a redirect target can harvest custom authentication headers such as X-Auth-Token, enabling downstream impersonation of monitoring plugins against protected APIs.

Affected Products

linuxfabrik-lib versions prior to 6.0.0
Linuxfabrik monitoring plugins that invoke lib.url.fetch() with custom credential headers
Downstream integrations relying on the library for authenticated HTTP requests

Discovery Timeline

2026-07-29 - CVE-2026-67435 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67435

Vulnerability Analysis

The vulnerability resides in the lib.url.fetch() helper of linuxfabrik-lib. The function performs HTTP requests on behalf of monitoring plugins and transparently follows HTTP redirects. When a redirect target resides on a different origin, the function stripped only the Authorization and Cookie headers before reissuing the request. All other caller-supplied headers, including custom credential headers such as X-Auth-Token, X-API-Key, or vendor-specific bearer variants, were forwarded to the new origin.

An attacker who controls or compromises a server contacted by a monitoring probe can respond with a 3xx redirect pointing to an attacker-controlled host. The library then replays the authenticated request, transmitting the sensitive header to the attacker. The captured token can be replayed against the legitimate API to read monitoring data or perform actions granted to the monitoring account.

Root Cause

The redirect-handling logic in lib/url.py maintained an incomplete deny list of headers to strip on cross-origin redirects. Because the filter enumerated only Authorization and Cookie, any other secret-bearing header remained attached to the follow-up request. Secure HTTP clients must either drop all caller-supplied headers on cross-origin redirects or apply an allow list, which this implementation did not do.

Attack Vector

Exploitation requires the victim to issue an authenticated request via lib.url.fetch() to a host the attacker can influence, either through DNS control, TLS certificate compromise, or by owning a legitimate endpoint. The attacker responds with a redirect such as HTTP/1.1 302 Found and a Location header pointing to their collection endpoint. The library follows the redirect and delivers the sensitive header, which the attacker logs and reuses.

python

 """Get for example HTML or JSON from an URL."""
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026070301'
+__version__ = '2026070700'
 
 import base64
 import json

Source: GitHub Commit 6573ff9 — the patch in url.py drops credential headers on cross-origin redirects.

Detection Methods for CVE-2026-67435

Indicators of Compromise

Outbound HTTP requests from monitoring hosts to unexpected external domains carrying headers like X-Auth-Token, X-API-Key, or vendor-specific authentication headers.
Redirect responses (301, 302, 307, 308) originating from monitored endpoints that point to unrelated origins.
Reuse of monitoring service tokens from IP addresses outside the monitoring infrastructure.

Detection Strategies

Inspect proxy or egress firewall logs for Location headers that cross origin boundaries on requests initiated by Linuxfabrik monitoring plugins.
Correlate authenticated API access with source addresses to identify token reuse from non-monitoring hosts.
Audit installed linuxfabrik-lib versions across monitoring servers and flag any release earlier than 6.0.0.

Monitoring Recommendations

Enable TLS-terminating proxies with header logging in front of monitoring hosts to observe outbound authentication headers.
Alert on 3xx responses returned to lib.url.fetch() requests, since legitimate monitoring endpoints rarely redirect.
Rotate API tokens used by monitoring plugins and monitor authentication logs for anomalous geolocation or user-agent usage.

How to Mitigate CVE-2026-67435

Immediate Actions Required

Upgrade linuxfabrik-lib to version 6.0.0 or later on all systems running Linuxfabrik monitoring plugins.
Rotate any custom credential headers (X-Auth-Token, X-API-Key, vendor tokens) previously used with lib.url.fetch().
Review outbound egress logs from monitoring hosts for evidence of redirects to unexpected domains.

Patch Information

The fix is delivered in GitHub Release v6.0.0 and is described in GitHub Security Advisory GHSA-4jc5-g844-4x33. The change in commit 6573ff9 modifies url.py so that all caller-supplied credential headers are stripped when a redirect crosses origins.

Workarounds

Configure monitoring plugin targets to disallow following redirects, or pin endpoints to their canonical URLs to eliminate 3xx responses.
Restrict egress from monitoring hosts using an allow list of known API endpoints so redirects to attacker-controlled hosts fail to resolve.
Avoid supplying custom credential headers to lib.url.fetch() until the library is upgraded; use Authorization where possible, which the library already strips on redirect.

bash

# Upgrade linuxfabrik-lib to the patched release
pip install --upgrade 'linuxfabrik-lib>=6.0.0'

# Verify installed version
python -c "import lib; print(lib.__version__)"