CVE-2026-44431
Aliases:GHSA-qccp-gfcp-xxvcPYSEC-2026-141RHSA-2026:30169RHSA-2026:36732RHSA-2026:47091RHSA-2026:47092RHSA-2026:47126RHSA-2026:47129RHSA-2026:49927RHSA-2026:51045RHSA-2026:51152RHSA-2026:51157DEBIAN-CVE-2026-44431CGA-24fj-4r68-cf73CGA-29jx-jw3v-fcmqCGA-2qx7-r6hr-mvgrCGA-2rvr-57w6-vg5hCGA-2rxr-x95g-v5vcCGA-2rxx-gr9v-6x8mCGA-2vqm-2fxq-g7ccCGA-2wwp-3xvg-cr7wCGA-2x8q-6m25-jqjrCGA-32rh-x7h6-pfvwCGA-36hp-r4x4-75wjCGA-39pp-j5rw-25hjCGA-3hpq-562c-75g8CGA-3qhf-qq86-phr6CGA-3qxc-974c-jjxfCGA-4677-q3r9-5gmwCGA-4cch-4g89-wjw7CGA-4f2c-4qcw-wm57CGA-4jr4-hqc4-h5rcCGA-4rxm-gg2c-m23hCGA-59fc-76h6-6p97CGA-5r27-w83x-6739CGA-638p-66rp-85m6CGA-67rg-m47f-fm78CGA-6m35-mrc2-gvrqCGA-73g3-cq52-9p78CGA-73wm-79mr-v6gcCGA-768h-547c-jccjCGA-76w7-8h97-q6f7CGA-7gf6-73xr-fjrjCGA-7jhm-23wm-hq5cCGA-7pm3-7hj6-hr2mCGA-7vjw-wj7v-3cwqCGA-895j-g8jh-xgv8CGA-89v7-rfqc-6r3cCGA-8cfr-525w-r35fCGA-8g85-c5f9-j9c9CGA-9232-mcpr-ch85CGA-92c7-jj68-6vg8CGA-9629-cgwp-44fmCGA-9hvm-f3ff-4f74CGA-9j9x-8g9q-gf66CGA-9p2c-85q9-5vx7CGA-9p8m-cp3w-m96gCGA-9r2w-jcmc-gmfcCGA-9rm8-m2p5-m3x6CGA-9w35-5m9r-j5vmCGA-9w4v-9r7q-vfcwCGA-9w6c-45g7-r7jfCGA-c7r5-8fv4-76vmCGA-ch4f-5jxh-4qccCGA-cj8f-wg89-357xCGA-cjw3-vw4p-p9cjCGA-cvgc-f2hg-8fx9CGA-cw83-5364-hff3CGA-f2vr-3vfr-3wrpCGA-f3mf-xhjx-5pghCGA-f8cf-qcr2-749gCGA-fhp3-xjpg-458vCGA-fr3h-7mfj-rx23CGA-g5cq-rjg2-7733CGA-gg5c-mq2m-93g2CGA-ggcm-jmp8-hxjgCGA-ggpj-rxr5-9q4qCGA-h8j2-p7f6-hx4qCGA-hgjg-r5pv-3482CGA-hqg9-mgvv-cq3mCGA-hrj6-qvw6-f7fhCGA-j56p-qhrr-674pCGA-j62j-82pm-p772CGA-jc75-8wxv-54wjCGA-jg69-m6g7-34h6CGA-jhc4-jwhw-gwfmCGA-jhcv-77x7-f8pfCGA-jj64-743j-983vCGA-jmfh-2hf6-rpwfCGA-jvqx-gjhx-f6cwCGA-m6w2-x26r-3r44CGA-m78c-g4xv-5c2rCGA-mcwh-5mcx-93pjCGA-mh6v-7ffw-f3w5CGA-mj78-gwv2-533hCGA-mpp4-63j8-5v42CGA-mvph-7w56-q984CGA-mwq6-5xmw-hr97CGA-p4c2-3438-rxwfCGA-p4gg-v67q-q35jCGA-p6hj-vq5c-hxx5CGA-p8c4-p98j-cv8gCGA-phg4-fh86-fq5wCGA-pjq3-c84p-2r2hCGA-pv5h-5g8h-v4fqCGA-pwg9-wvcf-wmxrCGA-22vr-cf7w-m5g5CGA-243v-6cw2-3wq9CGA-25j9-h6w6-ch23CGA-26vr-3fw4-9m9rCGA-285p-6248-ggwfCGA-29x8-mq4p-qvp8CGA-2cwj-3q92-wqrxCGA-2fhf-j4g5-prxmCGA-2fjc-93rc-5j8pCGA-2fjw-x5pr-hxcxCGA-2hh7-2g88-jw92CGA-2j43-9h7m-pxpcCGA-2mmc-q365-493wCGA-2rgg-5683-r7jwCGA-2v7p-hxg2-635jCGA-2vxh-wq26-2c63CGA-2xhh-66wc-x343CGA-3c2r-crw2-5w8cCGA-3gcw-m456-vx2rCGA-3gqc-wmc4-pmhvCGA-3gqj-j4mm-9gmcCGA-3j5f-3cxh-4qxcCGA-3jcf-v5xx-gxvjCGA-3m2c-c7hv-mrjhCGA-3mmj-xq45-rgwjCGA-3r78-9wv2-rhm9CGA-3v53-p2h7-r3p6CGA-426q-vc2r-8q3xCGA-4272-wm8j-6jvhCGA-4294-644r-ghr8CGA-4335-2m37-92g9CGA-43m3-7q95-v888CGA-4455-xh9h-r8fxCGA-45m7-7cxj-mgf8CGA-46cw-vrq6-6m3mCGA-4hp3-fh43-9222CGA-4rgv-469f-3mj9CGA-4v3g-q9rm-3fcxCGA-4w6q-32wf-7fq6CGA-4xwc-7xp7-5q7vCGA-54f2-65f4-434xCGA-553p-r6qv-3ccwCGA-55qh-mx2v-h3whCGA-56cw-4m66-mccrCGA-56g8-8485-8q59CGA-56qj-6vcr-qjw7CGA-5758-hpxx-m7vhCGA-583x-9fm9-jwr5CGA-5fpp-vg78-vhw2CGA-5g9v-h525-c28wCGA-5mm7-mfwr-wvpqCGA-5ppf-5gh3-3gw7CGA-5qr5-fcq8-3872CGA-5v3v-rq89-fxxxCGA-5xxg-vc73-33xrCGA-6326-rrp4-82fmCGA-677x-w2pc-29f6CGA-69px-gp5w-56vgCGA-6j62-745c-p28pCGA-6pgw-7g29-xm6jCGA-6x73-c62p-qggcCGA-735v-4qmg-gvhjCGA-73cg-rxrf-79pxCGA-75j7-72cf-qpv8CGA-772h-gprj-8xwfCGA-77f4-hwhf-cvxxCGA-7cr6-pj86-c2m3CGA-7gwj-4vcc-cr64CGA-7h27-pc63-9q74CGA-7hpv-3mw8-qr8wCGA-7jm7-435w-r2x4CGA-7p39-29mf-5rhrCGA-7wq3-wv5f-2489CGA-82cp-3v3c-56v4CGA-83jj-8j2g-wp5pCGA-874x-fv6m-p92wCGA-8crr-fffq-5w37CGA-8jgq-g6qp-h883CGA-8m23-w99r-2g4rCGA-8p48-3p3h-g5x4CGA-8w7h-xrjv-r9w5CGA-8wc2-2qhp-8gxqCGA-8x95-g476-j7r2CGA-9373-qphm-m78gCGA-9458-r233-77cgCGA-94vv-2cff-wh8mCGA-95h3-hg98-rj4cCGA-98xg-wrmf-2xjpCGA-9f84-8rv4-cxwfCGA-9fwr-gqvg-838hCGA-9jv7-6r8j-grf9CGA-9m2q-5rmm-vg67CGA-9r8x-882g-ffrvCGA-9vrp-57cm-gc42CGA-c34x-mm6j-ph39CGA-c442-w5f2-m8cpCGA-ccg3-mfjx-4m76CGA-cg4v-xh3p-34pmCGA-cggh-qw68-8227CGA-cq9c-m7q5-gc98CGA-cqfw-gxx3-rvxvCGA-cr63-6cr2-2hfpCGA-cx3x-7r3p-qrp7CGA-f2vc-jf37-8qffCGA-f49w-972m-qwfxCGA-f4x5-24pv-7rhxCGA-f5fw-pmpx-f595CGA-f6jv-9328-rhwpCGA-f85m-h768-7p9wCGA-fcmc-43w9-q2fgCGA-ffj4-wrfr-f5q8CGA-ffxv-rj86-x3m3CGA-fhch-hc62-2prcCGA-fjp5-vj4q-2qgxCGA-fmh8-vh46-c9c3CGA-fw5c-32mp-qjw8CGA-g479-396w-54h5CGA-g5ff-8rm2-45f2CGA-g6x4-h935-mww7CGA-g772-535j-hqghCGA-gcv9-j85r-wcrfCGA-gfq9-cccq-ph2vCGA-ghgj-hx9m-2rmhCGA-gqq2-8r69-57v6CGA-gv5p-mv69-5vfwCGA-gw8j-3qjp-68rrCGA-gwpf-53hj-25j6CGA-gwx2-h5pw-2w4xCGA-gxh3-p7p4-62cqCGA-h2w6-h24x-vp7jCGA-h39f-p3gg-fmfxCGA-h52c-457w-gv7cCGA-h56w-qf7c-wwq7CGA-h7cq-767m-8772CGA-h8mm-cr4f-3p3gCGA-hc26-4cmg-qqgpCGA-hf88-w28p-4p4fCGA-hvqm-jjm8-mgcxCGA-j3jh-wv5f-wpc6CGA-j536-pr98-9x93CGA-j5qw-gfw4-xx9rCGA-j64j-hw4x-g3jgCGA-j68v-g685-h4jcCGA-jfm4-7g9c-37g3CGA-jgh7-cpjv-jmwvCGA-jq8h-xxp8-gj3rCGA-jv38-3gr2-pjj2CGA-m4vv-x5m8-4x3xCGA-m9pf-4xg9-p957CGA-mc7r-frgv-qfrxCGA-mcr9-qmpr-2fvfCGA-mf7m-jr78-pm2pCGA-mfp4-wmmr-wxh5CGA-mhcw-vf6r-988fCGA-mjjm-5qxg-374fCGA-mjjq-22rr-532xCGA-mphv-jh32-x6wrCGA-mpwv-6r5c-xfxfCGA-mq58-w9rg-3jp3CGA-mv78-c678-64w9CGA-mw3j-6653-25v9CGA-mx3g-v457-p6ppCGA-mx9j-cjjj-76h7CGA-p3hc-4r92-wcqrCGA-p4g6-gc6p-7jhvCGA-p4mr-6wp2-gfjrCGA-p5p7-vj94-wwwjCGA-p6jv-wh6w-hpvcCGA-p748-v92c-frv9CGA-p7wj-8m86-j2qjCGA-p969-3qhx-rch8CGA-phpq-j5fx-r477CGA-pjxv-x9pc-qwv9CGA-pmjp-pg4g-c4xrCGA-pwwr-r4mr-5924CGA-q45p-hpv7-rj2vCGA-q486-56v5-743hCGA-q62j-5cr9-fvr2CGA-q82f-jr73-mjf2CGA-qc3w-jf67-g24gCGA-qgqq-f3gh-9pgwCGA-qh6f-3q6v-mrqwCGA-qj8v-gpg3-63q5CGA-qjjj-x2gr-qc7gCGA-qjw7-g765-rphjCGA-qpm4-67mj-r32jCGA-qqrq-9wff-r2p5CGA-qr2f-7fcv-j98rCGA-qvmm-qrfh-pmp4CGA-qvqh-mrqp-3hm7CGA-qwrj-fjw3-g88gCGA-r2h3-92r9-9fw6CGA-r44g-vmwg-52w3CGA-r7cj-744q-j3h6CGA-r7q4-vv92-5wmmCGA-r7rg-gcjj-rj53CGA-r9hx-wf2f-97hjCGA-rgf7-pjf7-53ggCGA-rhfc-5p5h-rmxrCGA-rmmg-2xcv-4x6wCGA-rw9r-pxcj-mmj5CGA-rwh7-5f5c-q44fCGA-rwx4-vqjg-jfpgCGA-v23v-x8hv-xvcvCGA-v295-657w-r8p4CGA-v4q5-cg83-j92fCGA-v52r-qw2p-prxpCGA-v53r-xv2r-rvx8CGA-v6j9-8pvh-73p6CGA-v7wg-6j87-cg27CGA-v937-xpr7-j4x5CGA-vgwh-rgf4-cjqrCGA-vm6f-7xjc-9vj6CGA-vmcj-6xm6-2mg9CGA-vp3c-rc6m-4h8hCGA-vr3q-vhmm-vhv8CGA-vvpm-3mpj-p5q4CGA-vxrj-pm63-vxhhCGA-w27q-7wcp-44xvCGA-w6j2-89vv-mvfcCGA-w89w-vg32-4hm4CGA-wc97-669w-fg26CGA-wh8w-5fwj-x28cCGA-whjw-p24j-qpcpCGA-whqj-xfrv-q5v2CGA-wj24-j2mf-p4g6CGA-wj4h-r64g-gfj4CGA-wj5g-cw7w-9gxmCGA-wprg-9v9h-8f3xCGA-wv95-53gm-qp9gCGA-wv9r-96pv-w5mfCGA-ww37-287h-r49gCGA-wwpj-w8x2-mhrvCGA-wx37-rv7m-jf9vCGA-x323-r4rx-3c7vCGA-x4q6-g3wm-9cpwCGA-x5g9-r3fx-rwhhCGA-x5p4-gxx9-jhv8CGA-x8h3-m42v-59fwCGA-x8mv-54x2-g7crCGA-x8vj-6cqm-m7j4CGA-x8xj-66rf-w9f2CGA-x939-h536-cf73CGA-x9c7-qhfx-2x23CGA-xc2r-ghc7-9cpwCGA-xc4h-rq2x-xmqgCGA-xc9r-qj3v-9vm2CGA-xfc4-xg2q-qg63CGA-xm32-395g-5343CGA-xpcf-2p7c-gx86CGA-xphj-qj5m-2c6gCGA-xr9p-7rvh-wx25CGA-xrg6-5v84-43j4CGA-xrhg-mfwx-wqmxCGA-xvgv-8w45-jvfcCGA-xw7x-vvfq-w5qxCGA-xw99-4f43-56xmCGA-463r-97v9-vwh8CGA-4fr8-q2wj-fm8cCGA-9cj6-53qj-6fm2CGA-fx84-5r55-pw68CGA-g4f4-fv5v-wxfvCGA-m6pg-q27m-6mhpCGA-qr8w-qh2w-m3rrCGA-w35p-rgf9-48g5CGA-wwm6-jhrp-jjrhCGA-p793-m2vw-v7wv
Advisory lineage Upstream: 0 Downstream: 23
Modified
Published: 13 May 2026, 15:20
Last modified:26 Jun 2026, 11:01
Vulnerability Summary
Overall Risk (default)
medium
33/100 CVSS Score
8.2 HIGH
v4.0 (cve.org)
EPSS Score
0.33% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
13 May 2026, 15:20
Published
Vulnerability first disclosed
26 Jun 2026, 11:01
Last Modified
Vulnerability information updated
Description
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
CVSS Metrics
- v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.33%• Percentile: 27%
Techniques & Countermeasures
- CWE-200•Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected Systems
- chainguard•airflow-2
all
- chainguard•airflow-3
< 3.2.1-r4
- chainguard•airflow-core-2
all
- chainguard•airflow-core-3
< 3.2.1-r1
- chainguard•ansible-operator
< 1.42.2-r7 | < 1.42.3-r1
- chainguard•ansible-operator-fips
< 1.42.2-r8
- chainguard•authentik-2025.12
< 2025.12.4-r9
- chainguard•authentik-2026.2
< 2026.2.1-r9
- chainguard•authentik-fips-2025.12
< 2025.12.4-r7
- chainguard•authentik-fips-2026.2
< 2026.2.1-r6
- chainguard•aws-cli-1
< 1.45.7-r0
- chainguard•aws-cli-2
< 2.34.55-r0
- chainguard•awx
< 24.6.1-r36
- chainguard•az
< 2.86.0-r0
- chainguard•azure-functions-host-python3.11-worker
< 4.1052.100-r1
- chainguard•azure-functions-host-python3.12-worker
< 4.1052.100-r1
- chainguard•azure-functions-host-python3.13-worker
< 4.1052.100-r1
- chainguard•azureml-inference-server-http
< 1.5.1-r3
- chainguard•azureml-inference-server-http-fips
< 1.5.1-r3
- chainguard•barman
< 3.18.0-r4
- chainguard•barman-cloudnative-pg
< 3.18.0-r4
- chainguard•confluent-docker-utils
< 0.0.172-r0
- chainguard•dagster-fips
< 1.13.3-r1
- chainguard•dask-kubernetes
< 2026.3.0-r5
- chainguard•datadog-agent-7.71
< 7.71.2-r26
- chainguard•datadog-agent-7.71-core-integrations
< 7.71.2-r26 | all
- chainguard•datadog-agent-7.72
< 7.72.4-r27
- chainguard•datadog-agent-7.72-core-integrations
all | < 7.72.4-r27
- chainguard•datadog-agent-7.73
< 7.73.3-r20
- chainguard•datadog-agent-7.73-core-integrations
< 7.73.3-r24 | < 7.73.3-r20
- chainguard•datadog-agent-7.74
< 7.74.1-r19
- chainguard•datadog-agent-7.74-core-integrations
all | < 7.74.1-r19
- chainguard•datadog-agent-7.75
< 7.75.4-r10
- chainguard•datadog-agent-7.75-core-integrations
< 7.75.4-r10 | all
- chainguard•datadog-agent-7.76
< 7.76.3-r22 | < 7.76.3-r41 | all
- chainguard•datadog-agent-7.76-core-integrations
< 7.76.3-r22 | < 7.76.3-r21 | all | < 7.76.3-r41
- chainguard•datadog-agent-7.77
< 7.77.3-r15
- chainguard•datadog-agent-7.77-core-integrations
< 7.77.3-r15 | < 7.77.3-r10
- chainguard•datadog-agent-7.78
< 7.78.4-r10
- chainguard•datadog-agent-7.78-core-integrations
< 7.78.4-r10 | < 7.78.4-r6
- chainguard•datadog-agent-7.79
< 7.79.2-r2
- chainguard•datadog-agent-7.79-core-integrations
< 7.79.2-r1 | < 7.79.2-r2
- chainguard•datadog-agent-7.80-core-integrations
< 7.80.4-r11 | all
- chainguard•datadog-agent-7.80-oci-compat
all
- chainguard•datadog-agent-7.80-s6-overlay
all
- chainguard•datadog-agent-7.81-core-integrations
all
- chainguard•datadog-agent-fips-7.71
< 7.71.2-r21
- chainguard•datadog-agent-fips-7.71-core-integrations
< 7.71.2-r21 | all
- chainguard•datadog-agent-fips-7.72
< 7.72.4-r18
- chainguard•datadog-agent-fips-7.72-core-integrations
< 7.72.4-r18 | all
Showing first 50 affected entries in server-rendered view.
References (33)
- https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc
- https://github.com/urllib3/urllib3
- https://nvd.nist.gov/vuln/detail/CVE-2026-44431
- https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html
- https://access.redhat.com/errata/RHSA-2026:30169
- https://images.redhat.com/
- https://access.redhat.com/security/cve/CVE-2026-44431
- https://access.redhat.com/security/updates/classification/
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30169.json
- https://bugzilla.redhat.com/show_bug.cgi?id=2477167
- https://www.cve.org/CVERecord?id=CVE-2026-44431
- https://access.redhat.com/errata/RHSA-2026:36732
- https://access.redhat.com/security/updates/classification/#moderate
- https://issues.redhat.com/browse/RHEL-184858
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36732.json
- https://access.redhat.com/errata/RHSA-2026:47091
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47091.json
- https://access.redhat.com/errata/RHSA-2026:47092
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47092.json
- https://access.redhat.com/errata/RHSA-2026:47126
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47126.json
- https://access.redhat.com/errata/RHSA-2026:47129
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47129.json
- https://access.redhat.com/errata/RHSA-2026:49927
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49927.json
- https://access.redhat.com/errata/RHSA-2026:51045
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51045.json
- https://access.redhat.com/errata/RHSA-2026:51152
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51152.json
- https://access.redhat.com/errata/RHSA-2026:51157
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51157.json
- https://security-tracker.debian.org/tracker/CVE-2026-44431
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44431.json