CVE-2026-63481 in Hurl
Summary
by MITRE • 08/20/2026
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Hurl versions prior to 8.1.0 represents a significant flaw in the handling of HTTP redirects, specifically concerning the leakage of sensitive authentication and session data across host boundaries. Hurl is widely used as a command-line tool for defining and testing HTTP requests via plain text files, making it a common utility in development and quality assurance pipelines where security headers are frequently tested or manipulated. The core issue lies within the redirect handling logic located in the http/client.rs module of version 8.0.1 and earlier. When an HTTP response triggers a redirection to a different host, the tool correctly strips standard Authorization headers, Cookie headers, and basic-auth credentials to prevent credential leakage according to general web security best practices. However, it fails to apply this same sanitization logic to cookies that are explicitly defined within the dedicated [Cookies] section of the Hurl specification file.
This inconsistency creates a specific attack vector where an attacker controlling or influencing the redirect target can receive session cookies intended for the original host. In standard web security models, such as those outlined in RFC 6265, cookies should be scoped to their origin domain and path to prevent cross-site request forgery and unauthorized access. By carrying over these [Cookies] section entries during a cross-host redirect, Hurl effectively bypasses this scoping mechanism. An attacker could craft a malicious HTTP response that redirects the client from a trusted internal or external service to an attacker-controlled server. Upon following this redirect, the tool would transmit the sensitive cookies associated with the original context to the new host, potentially allowing the attacker to hijack user sessions, escalate privileges, or access restricted resources on behalf of the victim.
From a technical classification perspective, this vulnerability aligns closely with CWE-201: Information Exposure Through Sent Data, as it involves the unintended transmission of sensitive information to an unauthorized party. It also relates to CWE-643: Improper Control of Interaction Between Components, specifically regarding how different parts of the HTTP client handle state during protocol transitions like redirection. In terms of the MITRE ATT&CK framework, this behavior facilitates reconnaissance and credential access techniques, particularly those involving session hijacking or unauthorized data exfiltration through legitimate application functionality. The distinction between raw Cookie headers being stripped while [Cookies] section entries are preserved highlights a gap in the implementation's consistency check for all forms of cookie transmission mechanisms supported by the tool.
The operational impact of this flaw is primarily relevant to environments where Hurl is used against systems that may be subject to redirect manipulation or when testing applications with complex redirection logic involving third-party domains. While the risk might be considered lower if Hurl is strictly used in isolated, internal development environments without exposure to untrusted networks, it poses a serious security risk in CI/CD pipelines or automated testing suites that interact with external services or potentially compromised endpoints. The leakage of session cookies can lead to account takeover and unauthorized access to backend systems, undermining the integrity of the applications being tested.
To mitigate this vulnerability, organizations using Hurl must immediately upgrade to version 8.1.0 or later, where the redirect handling logic has been corrected to strip all forms of cookie data, including those from the [Cookies] section, when a cross-host redirect occurs. Until an upgrade is feasible, teams should audit their test scripts for any reliance on cookies defined in the [Cookies] section during redirects and consider implementing manual header stripping or using alternative testing tools that do not exhibit this flaw. Additionally, security awareness training for developers and QA engineers involved in API testing can help identify such misconfigurations early in the development lifecycle. Regular updates of third-party developer tools are essential to maintain a secure software supply chain and prevent inadvertent data leakage during automated processes.