CVE-2026-55403 in datamodel-code-generator
Summary
by MITRE • 07/29/2026
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The datamodel-code-generator tool presents a significant security vulnerability in its handling of HTTP redirects when processing remote schema definitions. This flaw exists in versions prior to 0.63.0 and specifically affects the src/datamodel_code_generator/http.py module where the get_body function operates. The vulnerability stems from improper header management during cross-origin redirect scenarios, creating an avenue for credential leakage between different host domains.
The technical implementation issue occurs when the tool follows redirects from one domain to another while fetching remote schema files. During this process, the Authorization, Cookie, and Proxy-Authorization headers are inadvertently carried forward to subsequent redirect targets. This behavior violates fundamental security principles of credential scoping and access control, as authentication tokens and session cookies intended for the original schema host become accessible to potentially untrusted redirect destinations.
This vulnerability directly maps to CWE-200, which addresses information exposure through improper header handling during HTTP operations. The flaw enables a form of credential leakage that aligns with ATT&CK technique T1566.001, specifically involving the exploitation of web services to obtain credentials. When an attacker controls or can influence redirect targets, they can potentially intercept sensitive authentication information that was originally scoped to a different domain.
The operational impact of this vulnerability extends beyond simple credential leakage, as it creates opportunities for unauthorized access to protected schema resources. Attackers could craft malicious redirect chains that capture authentication tokens intended for legitimate schema repositories, potentially enabling them to access restricted data or perform unauthorized operations against the original schema host. The issue is particularly concerning in environments where schema definitions are fetched from untrusted sources or when organizations rely on authenticated schema fetching for sensitive data processing.
Organizations using datamodel-code-generator should immediately upgrade to version 0.63.0 or later to remediate this vulnerability. The fix implemented in the newer version properly isolates headers during redirect operations, ensuring that authentication credentials remain scoped to their original target domains. Security teams should also monitor their schema fetching operations for any unusual redirect patterns and consider implementing additional network-level controls to prevent unauthorized cross-origin access attempts. Proper input validation and header sanitization practices should be enforced when processing remote schema definitions to maintain security boundaries between different host contexts.