{"id":"EUVD-2026-30323","enisaUuid":"ae01f162-562a-3180-95b8-ff5cec3fb970","description":"The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.","datePublished":"May 14, 2026, 3:58:57 PM","dateUpdated":"May 14, 2026, 7:51:10 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9\n","aliases":"CVE-2026-44503\n","assigner":"GitHub_M","epss":0.64,"enisaIdProduct":[{"id":"0ca9b616-c15b-37e2-9ea8-338e3aafc516","product":{"name":"microsoft-kiota-http","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.9"},{"id":"0f719855-a9b3-3fee-b5dd-4dd03b808895","product":{"name":"Microsoft.Kiota.Abstractions","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.22.0"},{"id":"64a24d61-c686-38c6-9ba4-8cd4fb9fa36e","product":{"name":"microsoft-kiota-abstractions","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.1"},{"id":"b720d803-c44d-3742-b40e-168c4783505e","product":{"name":"kiota-java","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.1"},{"id":"c615cfe2-6657-38ed-85ab-61a3b63754bb","product":{"name":"github.com/microsoft/kiota-http-go","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.5.5"},{"id":"d7e0189d-ff70-30b2-87ac-9f980f3e57d9","product":{"name":"kiota-typescript","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.0.0-preview.100"}],"enisaIdVendor":[{"id":"0012eebc-9105-3f56-adce-fb84a0672d92","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"1ff6ae85-27d6-3b2c-bd15-4bb777069b65","vulnerability":{"id":"PYSEC-2026-2647","description":"Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect","datePublished":"Jul 13, 2026, 3:15:40 PM","dateUpdated":"Jul 13, 2026, 4:04:51 PM","baseScore":0.0,"references":"https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44503\nhttps://github.com/microsoft/kiota-java\nhttps://pypi.org/project/microsoft-kiota-http\nhttps://github.com/advisories/GHSA-7j59-v9qr-6fq9\n","enisa_id":"EUVD-2026-30323\n","aliases":"CVE-2026-44503\nGHSA-7j59-v9qr-6fq9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:10:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"21cbb8a0-7035-329f-a761-302e7fb10fe7","vulnerability":{"id":"GHSA-7j59-v9qr-6fq9","description":"Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect","datePublished":"May 7, 2026, 1:49:01 AM","dateUpdated":"Jul 21, 2026, 1:52:32 PM","baseScore":0.0,"references":"https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44503\nhttps://github.com/advisories/GHSA-7j59-v9qr-6fq9\nhttps://github.com/microsoft/kiota-java\nhttps://github.com/pypa/advisory-database/tree/main/vulns/microsoft-kiota-http/PYSEC-2026-2647.yaml\nhttps://pypi.org/project/microsoft-kiota-http\n","enisa_id":"EUVD-2026-30323\n","aliases":"CVE-2026-44503\nGHSA-7j59-v9qr-6fq9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"41ea5155-8089-35a8-a370-264a6c36c45d","vulnerability":{"id":"CVE-2026-44503","description":"The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.","datePublished":"May 14, 2026, 3:58:57 PM","dateUpdated":"May 14, 2026, 7:51:10 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9\n","enisa_id":"EUVD-2026-30323\n","assigner":"GitHub_M","epss":0.64,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"345e5aea-96ae-30a4-92be-716b820b8195","product":{"name":"github.com/microsoft/kiota-http-go","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.5.5"},{"id":"36c3a82c-64e2-3fd5-89a9-ff7444ab527d","product":{"name":"Microsoft.Kiota.Abstractions","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.22.0"},{"id":"5d619016-b84c-3b2b-90c4-e202d30ae476","product":{"name":"kiota-typescript","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.0.0-preview.100"},{"id":"ce042377-4460-3763-8d60-6c772c5ba942","product":{"name":"kiota-java","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.1"},{"id":"d9364e1a-038a-38a2-80bd-7fb768bc416e","product":{"name":"microsoft-kiota-abstractions","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.1"},{"id":"e23463cc-9d0f-3017-a835-394c1008b254","product":{"name":"microsoft-kiota-http","vendor":{"name":"Microsoft"}},"product_version":"\u003c 1.9.9"}],"vulnerabilityVendor":[{"id":"635c5a43-468b-321e-8817-d84fa20cf26c","vendor":{"name":"Microsoft"}}]}}],"enisaIdAdvisory":[]}