medium 6.1

CVE-2026-54770 json

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

published 2026-08-20 2 mo ago modified 2026-10-18 21 d ago also EUVD-2026-63467 , GHSA-6hx8-3wjj-gr8g , PYSEC-2026-3943

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

Patch / fix

fixed in 2 distros 4 links 1

pypi webob 1.8.11
pylonsproject webob 1.8.11

debian suse opensuse azure linux

python-webob Debian 14 1:1.8.11-1

debian advisories DEBIAN-CVE-2026-54770

python-WebOb SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7 1.7.4-150000.3.9.1
python-WebOb SLE Module for Public Cloud 12 1.2.3-3.6.1

suse advisories SUSE-SU-2026:4765-1 SUSE-SU-2026:4351-1

python-WebOb openSUSE Tumbleweed 1.8.11-1.1

opensuse advisories openSUSE-SU-2026:11864-1

python-webob Azure Linux 3.0 1.8.11-1

azure linux advisories AZL-97575

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/Pylons/webob@ff89560 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54770 updated 2026-11-04 cvss 7.4

webob: WebOb: Open redirect vulnerability leading to phishing and token theft

Red Hat Ceph Storage 4 python2-webob, python3-webob Red Hat Ceph Storage 7 rhceph/rhceph-7-rhel9 Red Hat Ceph Storage 8 rhceph/rhceph-8-rhel9
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9, openshift4/ose-ironic-agent-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-ironic-rhel9, openshift5/ose-ironic-agent-rhel9 Red Hat OpenStack Platform 16.2 python3-webob, rhosp-rhel8/openstack-ec2-api, rhosp-rhel8/openstack-horizon, rhosp-rhel8/openstack-tempest, rhosp-rhel8/openstack-aodh-api, rhosp-rhel8/openstack-heat-all, +82 more Red Hat OpenStack Platform 17.1 python3-webob, python-webob 0.9.6.1-3.el6 Red Hat OpenStack Platform 18.0 python-webob 0.9.6.1-3.el6, rhoso/openstack-horizon-rhel9, rhoso/openstack-aodh-api-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-keystone-rhel9, rhoso/openstack-nova-api-rhel9, +68 more
affected: workaround, no fix available
Red Hat OpenStack Platform 13.0 - ELS python-webob 1.7.2-2.el7ost
fixed: vendor fix RHSA-2026:94039
Red Hat Quay 3.9 quay/quay-rhel8 1790808443
fixed: vendor fix RHSA-2026:77656
Red Hat Quay 3.10 quay/quay-rhel8 1791462428
fixed: vendor fix RHSA-2026:79366
Red Hat Quay 3.12 quay/quay-rhel8 1791314514
fixed: vendor fix RHSA-2026:79546
Red Hat Quay 3.16 quay/quay-rhel9 1789563753
fixed: vendor fix RHSA-2026:69255
Red Hat Quay 3.17 quay/quay-rhel9 1790690298
fixed: vendor fix RHSA-2026:74511

show 4 more

Red Hat Quay 3.18 quay/quay-rhel9 1791265590
fixed: vendor fix RHSA-2026:81110
Red Hat Enterprise Linux 6 python-webob 0.9.6.1-3.el6 Red Hat Enterprise Linux 7 python-webob 0.9.6.1-3.el6
not affected: vulnerable code not present
Red Hat OpenShift Container Platform 4 python2-webob, python3-webob
not affected: component not present
Red Hat OpenStack Platform 13.0 - ELS python-nova 17.0.13-43.el7ost, openstack-heat 10.0.3-21.el7ost, openstack-nova 17.0.13-43.el7ost, python-keystone 13.0.4-10.el7ost, openstack-heat-api 10.0.3-21.el7ost, openstack-keystone 13.0.4-10.el7ost, +19 more Red Hat Quay 3.9 quay/clair-rhel8 1790697042, quay/quay-builder-rhel8 1790400755, quay/quay-operator-rhel8 1790399891, quay/quay-operator-bundle 1790903947, quay/quay-bridge-operator-rhel8 1790399899, quay/quay-bridge-operator-bundle 1790400430, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1791318071, quay/quay-builder-rhel8 1791218455, quay/quay-operator-rhel8 1790399749, quay/quay-operator-bundle 1791465969, quay/quay-bridge-operator-rhel8 1790400341, quay/quay-bridge-operator-bundle 1790401388, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1791318122, quay/quay-builder-rhel8 1791314224, quay/quay-operator-rhel8 1791435060, quay/quay-operator-bundle 1791436613, quay/quay-bridge-operator-rhel8 1791390151, quay/quay-bridge-operator-bundle 1791390652, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1789191202, quay/quay-builder-rhel9 1789492236, quay/quay-operator-rhel9 1789190909, quay/quay-operator-bundle 1789627085, quay/quay-bridge-operator-rhel9 1789191073, quay/quay-bridge-operator-bundle 1789191920, +3 more Red Hat Quay 3.17 quay/clair-rhel9 1790689867, quay/quay-builder-rhel9 1790484991, quay/quay-operator-rhel9 1790689856, quay/quay-operator-bundle 1790696576, quay/quay-bridge-operator-rhel9 1790403610, quay/quay-bridge-operator-bundle 1790404339, +3 more

+1 more productsfewer

Red Hat Quay 3.18 quay/clair-rhel9 1791279250, quay/quay-builder-rhel9 1791305715, quay/quay-rhel9-operator 1791305677, quay/quay-operator-bundle 1791306533, quay/quay-bridge-rhel9-operator 1791279118, quay/quay-bridge-operator-bundle 1791298533, +3 more

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-25)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	webob	<1.8.11	1.8.11

Affected products

Pylons webob

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

github.com /Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07
web
github.com /Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g
exploit, web
github.com /Pylons/webob/tree/1.8.11
web
nvd.nist.gov /vuln/detail/CVE-2026-54770
advisory
github.com /Pylons/webob
package
pypi.org /project/webob
package
github.com /advisories/GHSA-6hx8-3wjj-gr8g
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary