CVE-2026-12547 - Vulnerability Details - OpenCVE

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux

No data.

No data.

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-12547
https://bugzilla.redhat.com/show_bug.cgi?id=2489994
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506

History

Tue, 21 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 21 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Description		SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
Title		Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch
First Time appeared		Redhat Redhat enterprise Linux
Weaknesses		CWE-201
CPEs		cpe:/o:redhat:enterprise_linux:10
Vendors & Products		Redhat Redhat enterprise Linux
References		https://access.redhat.com/security/cve/CVE-2026-12547 https://bugzilla.redhat.com/show_bug.cgi?id=2489994 https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506
Metrics		cvssV3_1 `{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-07-21T18:35:53.214Z

Updated: 2026-07-21T19:14:49.960Z

Reserved: 2026-06-17T18:09:30.319Z

Link: CVE-2026-12547

Vulnrichment

Updated: 2026-07-21T19:03:10.203Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12547", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-17T18:09:30.319Z", "datePublished": "2026-07-21T18:35:53.214Z", "dateUpdated": "2026-07-21T19:14:49.960Z"}, "containers": {"cna": {"title": "Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup3", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:10"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-12547", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489994", "name": "RHBZ#2489994", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506"}], "datePublic": "2026-04-25T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-201: Insertion of Sensitive Information Into Sent Data", "workarounds": [{"lang": "en", "value": "If changing desktop proxy settings, close any applications using libsoup, then restart the application after the setting has been changed."}], "timeline": [{"lang": "en", "time": "2026-06-17T18:01:37.602Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Cavid (Yes We Hack) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T19:14:49.960Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T19:02:39.410894Z", "id": "CVE-2026-12547", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T19:06:28.077Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12547", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T19:02:39.410894Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T19:03:10.203Z"}}], "cna": {"title": "Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch", "credits": [{"lang": "en", "value": "Red Hat would like to thank Cavid (Yes We Hack) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libsoup3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-06-17T18:01:37.602Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-04-25T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-12547", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489994", "name": "RHBZ#2489994", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/506"}], "workarounds": [{"lang": "en", "value": "If changing desktop proxy settings, close any applications using libsoup, then restart the application after the setting has been changed."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T19:14:49.960Z"}, "x_redhatCweChain": "CWE-201: Insertion of Sensitive Information Into Sent Data"}}, "cveMetadata": {"cveId": "CVE-2026-12547", "state": "PUBLISHED", "dateUpdated": "2026-07-21T19:14:49.960Z", "dateReserved": "2026-06-17T18:09:30.319Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-07-21T18:35:53.214Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}