Skip to content
Fencer Vulns
high 7.5

CVE-2026-40895 json

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

published 2026-04-14 6 mo ago modified 2026-11-03 6 d ago also EUVD-2026-24472 , GHSA-r4q5-vmmm-2653

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Patch / fix

  • npm follow-redirects 1.16.0
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-9
  • Red Hat Cluster Observability Operator 1.5.0 1781116387, 1781116392, 1781116645, 1781116658
  • Red Hat multicluster engine for Kubernetes 2.1 1780917531
  • Red Hat multicluster engine for Kubernetes 2.11 1780910888
  • Red Hat multicluster engine for Kubernetes 2.6 1778511348
  • Red Hat multicluster engine for Kubernetes 2.8 1778383863
  • Red Hat multicluster engine for Kubernetes 2.9 1778532610
  • Red Hat Network Observability (NETOBSERV) 1.11.0 1778508956, 1778510461
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1780876734
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823
  • Red Hat Red Hat Advanced Cluster Security 4.9 1779371594
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1779293013
  • Red Hat Red Hat Ansible Automation Platform 2.5 1780082949
  • Red Hat Red Hat Developer Hub 1.8 1779841586
  • Red Hat Red Hat Developer Hub 1.9 1777903262
  • Red Hat Red Hat Discovery 2 1778156756
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat Migration Toolkit for Applications 8.1 1785169013
  • Red Hat Red Hat OpenShift AI 2.25 1780467029, 1780467147, 1787801527
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • Red Hat Red Hat OpenShift Container Platform 4.17 1784803344
  • Red Hat Red Hat OpenShift Container Platform 4.18 1785278569
  • Red Hat Red Hat OpenShift Container Platform 4.19 1781708434, 1784634877
  • Red Hat Red Hat OpenShift Container Platform 4.20 1781695012, 1784731014
  • Red Hat Red Hat OpenShift Container Platform 4.21 1781731914, 1784713762
  • Red Hat Red Hat OpenShift Container Platform 4.22 1784125329
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779341289, 1779359423, 1779528224, 1779814592
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1778191378, 1778191473
  • node-follow-redirects Debian 14 1.16.0+~1.14.4-1

debian advisories DEBIAN-CVE-2026-40895

  • node-follow-redirects Ubuntu Pro 18.04 LTS 1.2.4-1ubuntu0.18.04.1~esm2
  • node-follow-redirects Ubuntu Pro 20.04 LTS 1.2.4-1ubuntu0.20.04.1~esm2
  • node-follow-redirects Ubuntu Pro 22.04 LTS 1.14.9+~1.14.1-1ubuntu0.1~esm2
  • node-follow-redirects Ubuntu Pro 24.04 LTS 1.15.6+~1.14.4-1ubuntu0.1~esm1
  • node-follow-redirects Ubuntu Pro 26.04 LTS 1.15.11+~1.14.4-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-40895

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40895 updated cvss 7.5

follow-redirects: follow-redirects: Information disclosure via cross-domain redirects

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-hub, automation-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9, ansible-automation-platform/automation-dashboard-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 follow-redirects
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 follow-redirects
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: workaround, no fix available
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    affected: workaround, no fix planned “Will not fix”
show 25 more
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available
  • Red Hat Fuse 7 follow-redirects
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift Container Platform 4 openshift3/ose-console, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1781116392, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1781116645, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9 1781116658, cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 1781116387
    fixed: vendor fix RHSA-2026:26010
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-9
    fixed: vendor fix RHSA-2026:17789
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1778511348
    fixed: vendor fix RHSA-2026:17657
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778383863
    fixed: vendor fix RHSA-2026:17699
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1778532610
    fixed: vendor fix RHSA-2026:19109
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/console-mce-rhel9 1780917531
    fixed: vendor fix RHSA-2026:24536
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/console-mce-rhel9 1780910888
    fixed: vendor fix RHSA-2026:25271
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1778508956, network-observability 1778510461
    fixed: vendor fix RHSA-2026:16874
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1783451729
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/console-rhel9 1780876734
    fixed: vendor fix RHSA-2026:24539
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/console-rhel9 1780600823
    fixed: vendor fix RHSA-2026:25273
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1779371594
    fixed: vendor fix RHSA-2026:20938
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security 1779293013
    fixed: vendor fix RHSA-2026:20889
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1780082949
    fixed: vendor fix RHSA-2026:24766
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.8 rhdh/rhdh-hub-rhel9 1779841586
    fixed: vendor fix RHSA-2026:21338
  • Red Hat Developer Hub 1.9 rhdh 1777903262
    fixed: vendor fix RHSA-2026:13826
  • Red Hat Discovery 2 discovery 1778156756
    fixed: vendor fix RHSA-2026:14937
  • Red Hat Hardened Images grafana13.2 13.2.4-0.3.hum1
    fixed: vendor fix RHSA-2026:88541
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat Migration Toolkit for Applications 8.1 mta/mta-ui-rhel9 1785169013
    fixed: vendor fix RHSA-2026:50300
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1780467029, rhoai/odh-mod-arch-model-registry-rhel9 1780467147, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787801527
    fixed: vendor fix RHSA-2026:24977

20 more fixed, 68 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm follow-redirects
<1.16.0
1.16.0

Affected products

  • follow-redirects follow-redirects
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat Migration Toolkit for Applications 8.1
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.9
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat Node HealthCheck Operator
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.