Name: CVE-2026-44431: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2026-05-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-44431, CWE-200, CVSS 5.3, EPSS 0.00031

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

CVSS Details

CVSS 4.0 Base Score: 8.2 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 5.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade fence-agents-epsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-mdsUpgrade fence-agents-azure-armUpgrade fence-agents-eaton-snmpUpgrade fence-agents-allUpgrade fence-agents-amt-wsUpgrade resource-agentsUpgrade fence-agents-scsiUpgrade fence-agents-ilo-mpUpgrade fence-agents-gceUpgrade fence-agents-ipduUpgrade fence-agents-rsbUpgrade fence-agents-bladecenterUpgrade fence-agents-kdumpUpgrade fence-agents-virshUpgrade fence-agents-computeUpgrade fence-agents-rhevmUpgrade resource-agents-gcpUpgrade fence-agents-commonUpgrade fence-agents-intelmodularUpgrade fence-agents-apc-snmpUpgrade fence-agents-ifmibUpgrade fence-agents-vmware-soapUpgrade fence-agents-sbdUpgrade fence-agents-ilo-sshUpgrade fence-agents-ipmilanUpgrade fence-agents-aliyunUpgrade fence-agents-emersonUpgrade fence-agents-brocadeUpgrade fence-agents-wtiUpgrade fence-agents-mpathUpgrade fence-agents-ibm-powervsUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo2Upgrade fence-agents-awsUpgrade fence-agents-hpbladeUpgrade fence-agents-lparUpgrade fence-agents-ibmbladeUpgrade fence-agents-openstackUpgrade fence-agents-zvmUpgrade fence-agents-heuristics-pingUpgrade fence-agents-rsaUpgrade resource-agents-aliyunUpgrade python3.14-urllib3Upgrade python3-urllib3Upgrade python3.12-urllib3Upgrade fence-agents-vmware-restUpgrade fence-agents-drac5Upgrade fence-agents-cisco-ucsUpgrade resource-agents-pafUpgrade fence-agents-redfishUpgrade fence-agents-ibm-vpcUpgrade fence-agents-apc	Jun 25, 2026	Jun 23, 2026
Amazon Linux Ami 2	—	Upgrade python3-urllib3Upgrade python-urllib3	Jun 23, 2026	Jun 23, 2026
Debian	—	Upgrade python-urllib3	Jun 28, 2026	Jun 28, 2026
Oracle_linux	—	Upgrade fence-agents-ipmilanUpgrade fence-agents-kdumpUpgrade fence-agents-kubevirtUpgrade fence-agents-virshUpgrade fence-agents-apcUpgrade fence-agents-bladecenterUpgrade fence-agents-apc-snmpUpgrade fence-agents-brocadeUpgrade python3-urllib3Upgrade fence-agents-amt-wsUpgrade fence-agents-rhevmUpgrade fence-agents-ilo-sshUpgrade fence-agents-vmware-soapUpgrade fence-agents-commonUpgrade fence-agents-cisco-mdsUpgrade fence-agents-intelmodularUpgrade fence-agents-hpbladeUpgrade fence-agents-ilo-mpUpgrade fence-agents-scsiUpgrade fence-agents-mpathUpgrade fence-agents-ibmbladeUpgrade fence-agents-emersonUpgrade fence-agents-ipduUpgrade fence-agents-vmware-restUpgrade fence-agents-eaton-snmpUpgrade fence-agents-allUpgrade python3.12-urllib3Upgrade fence-agents-heuristics-pingUpgrade resource-agentsUpgrade fence-agents-sbdUpgrade fence-agents-cisco-ucsUpgrade fence-agents-wtiUpgrade fence-agents-ilo2Upgrade fence-agents-rsaUpgrade fence-agents-epsUpgrade fence-agents-lparUpgrade fence-agents-ibm-powervsUpgrade python3.14-urllib3Upgrade fence-agents-drac5Upgrade fence-agents-nutanix-ahvUpgrade fence-agents-redfishUpgrade fence-agents-ibm-vpcUpgrade fence-agents-rsbUpgrade fence-agents-computeUpgrade fence-agents-ifmibUpgrade fence-agents-ilo-moonshot	Oct 22, 2026	May 13, 2026
Redhat_linux	—	Upgrade fence-agents-ibmbladeUpgrade fence-agents-bladecenterUpgrade fence-agents-intelmodularUpgrade fence-agents-azure-armUpgrade fence-agents-scsiUpgrade fence-agents-amt-wsUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-aliyunUpgrade fence-agents-virshUpgrade fence-agents-apc-snmpUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-ilo-mpUpgrade fence-agents-allUpgrade fence-agents-emersonUpgrade fence-agents-epsUpgrade fence-agents-kdumpUpgrade fence-agents-ipduUpgrade fence-agents-ibm-powervsUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-nutanix-ahvUpgrade python3-urllib3Upgrade fence-agents-computeUpgrade fence-agents-rhevmUpgrade fence-agents-sbdUpgrade fence-agents-mpathUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ilo-moonshotUpgrade resource-agentsUpgrade fence-agents-vmware-soapUpgrade fence-agents-cisco-mdsUpgrade fence-agents-rsbUpgrade fence-agents-commonUpgrade fence-agents-debuginfoNo solution existsUpgrade fence-agents-ibm-vpcUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ipmilanUpgrade fence-agents-hpbladeUpgrade fence-agents-wtiUpgrade fence-agents-openstackUpgrade fence-agents-vmware-restUpgrade fence-agents-lparUpgrade fence-agents-kubevirtUpgrade python3.12-urllib3Upgrade fence-agents-rsaUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-ilo-sshUpgrade fence-agents-drac5Upgrade fence-agents-debugsourceUpgrade fence-agents-cisco-ucsUpgrade fence-agents-redfishUpgrade resource-agents-aliyunUpgrade fence-agents-ifmibUpgrade fence-agents-gceUpgrade resource-agents-aliyun-debuginfoUpgrade resource-agents-gcpUpgrade resource-agents-debugsourceUpgrade resource-agents-debuginfoUpgrade python3.14-urllib3Upgrade fence-agents-awsUpgrade fence-agents-brocadeUpgrade fence-agents-ilo2Upgrade fence-agents-apcUpgrade fence-agents-zvmUpgrade resource-agents-paf	Jun 24, 2026	May 13, 2026
Rocky_linux	—	Upgrade fence-agents-openstackUpgrade resource-agentsUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-kubevirtUpgrade resource-agents-pafUpgrade fence-agents-debuginfoUpgrade resource-agents-aliyunUpgrade resource-agents-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-azure-armUpgrade fence-agents-aliyunUpgrade fence-agents-allUpgrade fence-agents-kdump-debuginfoUpgrade resource-agents-gcpUpgrade fence-agents-kdumpUpgrade resource-agents-aliyun-debuginfoUpgrade resource-agents-debugsourceUpgrade fence-agents-redfish	Aug 7, 2026	Aug 6, 2026
Ubuntu	—	Upgrade python-urllib3 (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python3-urllib3	Jun 4, 2026	Jun 3, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence