CVE-2026-12547 in Red Hat
Summary
by MITRE • 07/21/2026
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability described involves a critical flaw in how authentication credentials are managed within the SoupAuthManager component, which is commonly used in web browsing and network communication applications. This issue stems from inadequate credential scoping mechanisms that fail to properly associate cached authentication tokens with their originating proxy authority. The technical implementation stores proxy authentication headers without establishing a clear relationship between the credentials and the specific proxy server they were intended for, creating a fundamental security gap that can be exploited by malicious actors.
The flaw manifests when system network configurations change, particularly through mechanisms like Web Proxy Auto-Discovery Protocol or manual system settings modifications. During these transitions, the application continues to utilize cached Proxy-Authorization headers that were originally generated for a different proxy server, effectively transferring authentication credentials between distinct network authorities without proper validation or re-authentication. This behavior violates fundamental security principles of credential isolation and creates an attack surface where sensitive authentication information can be inadvertently transmitted to unauthorized proxy servers.
From an operational impact perspective, this vulnerability creates significant risks for organizations relying on proxy-based network access controls and authentication mechanisms. The credential leakage occurs automatically during legitimate network configuration changes, making it particularly dangerous as users may not be aware of the compromised state. This flaw directly enables man-in-the-middle attacks where attackers can intercept and utilize cached credentials to gain unauthorized access to protected resources through different proxy servers, potentially leading to complete network compromise and data exfiltration.
The vulnerability aligns with CWE-257, which addresses insecure storage of credentials, and represents a specific implementation weakness in credential management systems. From an ATT&CK framework perspective, this issue maps to technique T1566.001 for credential access through phishing and T1046 for network service scanning that could leverage the leaked credentials. Organizations should implement proper credential scoping mechanisms that associate cached authentication tokens with specific proxy authority identifiers including hostnames, ports, and protocol specifications. Mitigation strategies include implementing strict credential validation before transmission, enforcing re-authentication during proxy configuration changes, and establishing secure credential storage practices that prevent cross-proxy credential leakage.
Security teams should monitor for instances of this vulnerability in their network infrastructure and application deployments, particularly in environments where dynamic proxy configuration occurs frequently. The recommended remediation involves modifying the SoupAuthManager to maintain separate credential caches per proxy authority, implementing automatic invalidation of cached credentials during proxy changes, and ensuring that authentication headers are only transmitted to the specific proxy server for which they were originally generated. This approach prevents the credential leakage scenario while maintaining legitimate network functionality and user experience.