CVE-2026-66339 in Red Hat
Summary
by MITRE • 07/25/2026
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides in the libsoup library which is widely used for HTTP client and server functionality in various applications including web browsers, email clients, and network utilities. The flaw manifests when a CONNECT tunnel is established through an HTTP proxy server, a common pattern in corporate environments where network traffic must pass through authenticated proxies. When this tunnel is created, the library incorrectly propagates the Proxy-Authorization header from the initial proxy authentication to all subsequent HTTPS requests that traverse the same tunnel connection. This behavior violates fundamental security principles governing how authentication credentials should be handled in proxy environments.
The technical implementation flaw stems from improper header management within the HTTP tunneling mechanism. During the CONNECT request phase, libsoup correctly authenticates with the proxy server using the Proxy-Authorization header containing credentials such as username and password or bearer tokens. However, when subsequent HTTPS requests are sent through the established tunnel, the library fails to strip or properly handle this authentication header before forwarding it to the ultimate destination server. This creates a scenario where the final server receives credentials that were intended solely for proxy authentication, effectively enabling unauthorized access to proxy credentials through simple network monitoring or packet inspection.
The operational impact of this vulnerability is significant particularly in enterprise environments where HTTP proxies are commonly deployed for security and traffic control purposes. An attacker who can intercept network traffic between the client and destination server could extract proxy credentials from the Proxy-Authorization header that gets transmitted with every HTTPS request. This disclosure allows attackers to impersonate legitimate users, gain access to restricted resources, or potentially escalate privileges within proxy-controlled networks. The vulnerability affects any application using libsoup versions prior to the patched release, making it particularly concerning for widely deployed software systems.
This issue aligns with CWE-284 Access Control and CWE-312 Cleartext Storage of Sensitive Information, as it represents a failure in access control mechanisms and exposes sensitive authentication data. From an ATT&CK perspective, this vulnerability maps to T1566 Credential Access and T1071.002 Application Layer Protocol. The flaw essentially allows for unauthorized credential harvesting through network traffic interception, representing a critical security weakness that undermines the integrity of proxy-based authentication systems. Organizations should immediately update their libsoup dependencies and implement network monitoring to detect potential credential exposure. Additionally, security teams should review proxy configurations and consider implementing additional authentication controls such as mutual TLS or token-based authentication methods to reduce the risk of credential compromise.
The root cause analysis reveals that this is a classic case of header propagation error in HTTP tunneling implementations where security boundaries are incorrectly maintained between proxy and destination server communications. Proper implementation would require explicit header filtering or stripping mechanisms to ensure that proxy-specific authentication information does not leak into destination server requests, thereby maintaining the separation of concerns between different network layers and authentication contexts.