elixir-tesla up to 1.18.2 Their Own Endpoint filter_headers case sensitivity

Summaryinfo

A vulnerability categorized as problematic has been discovered in elixir-tesla tesla up to 1.18.2. This affects an unknown function of the component Their Own Endpoint. Executing a manipulation of the argument filter_headers can lead to case sensitivity. This vulnerability appears as CVE-2026-48595. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in elixir-tesla tesla up to 1.18.2 and classified as problematic. This vulnerability affects an unknown functionality of the component Their Own Endpoint. The manipulation of the argument filter_headers with an unknown input leads to a case sensitivity vulnerability. The CWE definition for the vulnerability is CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. As an impact it is known to affect confidentiality. CVE summarizes:

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request. This issue affects tesla: from 1.4.0 before 1.18.3.

The weakness was presented by Peter Ullrich and Jonatan Männchen as GHSA-9m9w-gxf7-rh8m. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-48595 since 05/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.18.3 eliminates this vulnerability. Applying the patch db963dba67651b9abd1fc420a1d9679cf6efe182 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Vehicle Software

Vendor

• elixir-tesla

Name

• tesla

Version

• 1.18.0
• 1.18.1
• 1.18.2

License

• open-source

Website

• Product: https://github.com/elixir-tesla/tesla/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion