CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Modified

AliasesSUSE-SU-2026:22003-1SUSE-SU-2026:22011-1SUSE-SU-2026:2486-1+381 more

Published 13-05-2026Last modified 26-06-2026

Vulnerability summary

CVE-2026-44431 is a high (CVSS 8.2) vulnerability in python urllib3. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.2/10

010

High · v4.0 (CVE.org)

EPSS score

0.33%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

13-05-2026
PublishedVulnerability first disclosed.
26-06-2026
Last modifiedVulnerability information updated.

Description

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

CVSS metrics

10 scores · 8 sources · 2 versions

v4.08.2v3.15.3

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard167 products

airflow-2< 2.11.2-r26
airflow-3< 3.2.1-r4
airflow-core-2< 2.11.2-r11
airflow-core-3< 3.2.1-r1
ansible-operator< 1.42.2-r7 | < 1.42.3-r1

ansible-operator-fips< 1.42.2-r8
authentik-2025.12< 2025.12.4-r9
authentik-2026.2< 2026.2.1-r9
authentik-fips-2025.12< 2025.12.4-r7
authentik-fips-2026.2< 2026.2.1-r6
aws-cli-1< 1.45.7-r0
aws-cli-2< 2.34.55-r0
awx< 24.6.1-r36
az< 2.86.0-r0
azure-functions-host-python3.11-worker< 4.1052.100-r1
azure-functions-host-python3.12-worker< 4.1052.100-r1
azure-functions-host-python3.13-worker< 4.1052.100-r1
azureml-inference-server-http< 1.5.1-r3
azureml-inference-server-http-fips< 1.5.1-r3
barman< 3.18.0-r4
barman-cloudnative-pg< 3.18.0-r4
confluent-docker-utils< 0.0.172-r0
dagster-fips< 1.13.3-r1
dask-kubernetes< 2026.3.0-r5
datadog-agent-7.71< 7.71.2-r26
datadog-agent-7.71-core-integrations< 7.71.2-r26 | All versions (No fix recorded)
datadog-agent-7.72< 7.72.4-r27
datadog-agent-7.72-core-integrationsAll versions (No fix recorded) | < 7.72.4-r27
datadog-agent-7.73< 7.73.3-r20
datadog-agent-7.73-core-integrations< 7.73.3-r24 | < 7.73.3-r20
datadog-agent-7.74< 7.74.1-r19
datadog-agent-7.74-core-integrationsAll versions (No fix recorded) | < 7.74.1-r19
datadog-agent-7.75< 7.75.4-r10
datadog-agent-7.75-core-integrations< 7.75.4-r10 | All versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r41 | < 7.76.3-r22 | All versions (No fix recorded)
datadog-agent-7.76-core-integrations< 7.76.3-r41 | < 7.76.3-r21
datadog-agent-7.77< 7.77.3-r15
datadog-agent-7.77-core-integrations< 7.77.3-r15 | < 7.77.3-r10
datadog-agent-7.78< 7.78.4-r10
datadog-agent-7.78-core-integrations< 7.78.4-r10 | < 7.78.4-r6
datadog-agent-7.79< 7.79.2-r2
datadog-agent-7.79-core-integrations< 7.79.2-r1 | < 7.79.2-r2
datadog-agent-7.80-core-integrationsAll versions (No fix recorded) | < 7.80.4-r11
datadog-agent-7.80-oci-compatAll versions (No fix recorded)
datadog-agent-7.80-s6-overlayAll versions (No fix recorded)
datadog-agent-7.81-core-integrationsAll versions (No fix recorded)
datadog-agent-fips-7.71< 7.71.2-r21
datadog-agent-fips-7.71-core-integrations< 7.71.2-r21 | All versions (No fix recorded)
datadog-agent-fips-7.72< 7.72.4-r18
datadog-agent-fips-7.72-core-integrations< 7.72.4-r18 | All versions (No fix recorded)
datadog-agent-fips-7.73< 7.73.3-r17
datadog-agent-fips-7.73-core-integrations< 7.73.3-r17 | All versions (No fix recorded)
datadog-agent-fips-7.74< 7.74.1-r16
datadog-agent-fips-7.74-core-integrations< 7.74.1-r27 | < 7.74.1-r16
datadog-agent-fips-7.75< 7.75.4-r10
datadog-agent-fips-7.75-core-integrationsAll versions (No fix recorded) | < 7.75.4-r10
datadog-agent-fips-7.76< 7.76.3-r21
datadog-agent-fips-7.76-core-integrations< 7.76.3-r20 | < 7.76.3-r21
datadog-agent-fips-7.77< 7.77.3-r16
datadog-agent-fips-7.77-core-integrations< 7.77.3-r13 | < 7.77.3-r16
datadog-agent-fips-7.78< 7.78.4-r7
datadog-agent-fips-7.78-core-integrations< 7.78.4-r7 | < 7.78.4-r4
datadog-agent-fips-7.79< 7.79.2-r1
datadog-agent-fips-7.79-core-integrations< 7.79.2-r1 | < 7.79.2-r2
datadog-agent-fips-7.80-core-integrationsAll versions (No fix recorded)
datadog-agent-fips-7.81-core-integrationsAll versions (No fix recorded)
datahub-ingestion< 1.5.0.6-r0 | < 1.5.0.4-r1
datahub-ingestion-fips< 1.5.0.4-r0
dbt-bigquery< 1.10.3-r1
dbt-core< 1.11.10-r0
dbt-snowflake< 1.10.4-r2
duplicity< 3.0.7-r4
ggshield< 1.49.0-r2
gitlab-toolbox-ce-18.10< 18.10.6-r0
gitlab-toolbox-ce-18.11< 18.11.2-r1
gitlab-toolbox-ce-18.9< 18.9.7-r0
gitlab-toolbox-ce-fips-18.11< 18.11.2-r1
graalvm-25-graalpy-venv< 25.0.3-r3 | < 25.0.4.1-r6
httpie< 3.2.4-r10
jupyter-base-notebook< 7.5.6-r1
jwt-tool< 2.3.0-r6
katib-earlystopping< 0.19.0-r21
katib-suggestion-goptuna-compat< 0.19.0-r40
katib-suggestion-hyperband< 0.19.0-r21
katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r21
katib-suggestion-nas-darts< 0.19.0-r21
katib-suggestion-optuna-enas< 0.19.0-r21
katib-suggestion-pbt-enas< 0.19.0-r21
katib-suggestion-skopt-enas< 0.19.0-r21
keep-api< 0.51.0-r7
keep-api-fips< 0.51.0-r7
kubeflow-pipelines-apiserver< 2.16.1-r3
kubeflow-pipelines-visualization-server< 2.16.1-r1
kubeflow-volumes-web-app< 1.10.0-r18
label-studio< 1.23.0-r5
litellm< 1.83.14.0-r1
localstack< 4.14.0-r11
metaflow-service< 2.5.0-r11
metaflow-service-fips< 2.5.0-r4
mlflow< 3.13.0-r0 | < 3.16.0-r0
mlflow-fips< 3.12.0-r0
mlflow-iamguarded-compat< 3.13.0-r0
nemo< 2.7.3-r3 | < 2.7.3-r6
nemo-rl-cuda-13.0< 0.7.0-r1
nemo-rl-cuda-13.0-automodel< 0.7.0-r1
nemo-rl-cuda-13.0-mcore< 0.7.0-r1
nemo-rl-cuda-13.0-sglang< 0.7.0-r1
nemo-rl-cuda-13.0-vllm< 0.7.0-r1
neuvector-manager-cli< 5.5.1-r2
nvidia-nsight-compute-13.1< 2025.4.1.2-r2
nvidia-nsight-compute-13.2< 2026.1.1.2-r3
nvidia-nsight-compute-13.3< 2026.2.1.5-r1
opal< 0.9.5-r1
open-webui< 0.9.6-r1
openstack-kolla-toolbox-2025.1< 20.4.0-r7
openstack-kolla-toolbox-2025.1-fips< 20.4.0-r5
openstack-kolla-toolbox-2025.2< 21.1.0-r7
openstack-kolla-toolbox-2025.2-fips< 21.1.0-r6
openstack-kolla-toolbox-2026.1< 22.0.0-r3
openstack-kolla-toolbox-2026.1-fips< 22.0.0-r3
opentelemetry-python-instrumentation< 0.63.1-r0
pgadmin4< 9.15-r0 | < 9.15-r1
pgadmin4-fips< 9.15-r1
py3-cassandra-medusa< 0.28.0-r1 | < 0.29.0-r2
py3-hashin< 1.0.5-r6
py3.10-opentelemetry-exporter-otlp< 1.40.0-r1
py3.10-pip-base< 26.1.2-r1
py3.10-pipenv< 2026.6.2-r2
py3.11-opentelemetry-exporter-otlp< 1.40.0-r1
py3.11-pip-base< 26.1.2-r1
py3.11-pipenv< 2026.6.2-r2
py3.11-prefect< 3.7.0-r1
py3.11-prefect-fips< 3.7.0-r1
py3.12-aws-cli-1All versions (No fix recorded)
py3.12-opentelemetry-exporter-otlp< 1.40.0-r1
py3.12-pip-base< 26.1.2-r1
py3.12-pipenv< 2026.6.2-r2
py3.12-prefect< 3.7.0-r1
py3.12-prefect-fips< 3.7.0-r1
py3.13-opentelemetry-exporter-otlp< 1.40.0-r1
py3.13-pip-base< 26.1.2-r1
py3.13-pipenv< 2026.6.2-r2
py3.13-prefect< 3.7.0-r1
py3.13-prefect-fips< 3.7.0-r1
py3.13-scanner-test-libraries< 0.0.1-r4 | < 0.0.1-r2
py3.13-scanner-test-scanner-test-python-vulnerability-fixedAll versions (No fix recorded)
py3.13-scanner-test-scanner-test-python-vulnerability-unfixedAll versions (No fix recorded)
py3.14-pip-base< 26.1.2-r1
py3.14-prefect< 3.7.0-r0 | < 3.7.0-r1
py3.9-pip< 25.3-r0
pypy-3.10< 7.3.19-r20
pypy-3.11< 7.3.23-r4
request-1276< 0.28.0-r1 | < 0.29.0-r1
semgrep< 1.163.0-r0
spamcheck< 3.5.3-r10
superset-5.0< 5.0.0-r25
superset-6.0< 6.0.0-r12
synapse< 1.151.0-r3
tensorflow-cpu-jupyter< 2.21.0-r4 | < 2.21.0-r6
tensorflow-gpu-jupyter< 2.21.0-r6 | < 2.21.0-r4
text-generation-inference< 3.3.7-r12
tritonserver-backend-vllm-cuda-12.9< 25.9.0_git20260318-r1
tritonserver-backend-vllm-cuda-13.0< 25.11-r7
vast-csi< 2.6.5-r1
vllm-openai-cuda-12.9< 0.19.1-r2
wazuh-manager-framework< 4.14.4-r6
wazuh-manager-framework-fips< 4.14.5-r1

Show all 167

Wolfi33 products

airflow-3< 3.2.1-r4
aws-cli-2< 2.34.55-r0
az< 2.86.0-r0
confluent-docker-utils< 0.0.172-r0
dask-kubernetes< 2026.3.0-r5

Show all 33

2 vendors · 200 products · Showing 200 of 331

References

41 links

github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvcX Refsource CONFIRMWEBAdvisoryARTICLEREPORTMitigationVendor Advisory
lists.debian.org/debian-lts-announce/2026/06/msg00040.htmlWEB
www.suse.com/support/update/announcement/2026/suse-su-202622003-1/Advisory
bugzilla.suse.com/1265267REPORT
www.suse.com/security/cve/CVE-2026-44431WEB
www.suse.com/support/update/announcement/2026/suse-su-202622011-1/Advisory
www.suse.com/support/update/announcement/2026/suse-su-20262486-1/Advisory
nvd.nist.gov/vuln/detail/CVE-2026-44431AdvisoryOval
github.com/urllib3/urllib3PACKAGE
access.redhat.com/errata/RHSA-2026:30169Advisory

Show all 41 references