CVE-2026-89186

mpp · Vulnerability

CVSS 4.0 6.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89186

Published

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource. This issue affects mpp: from 0.1.0 before 0.16.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89186

Published

mpp

https://repo.hex.pm

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.MPP.Plug'"
                    ],
                    "packageName": "mpp",
                    "packageURL": "pkg:hex/mpp",
                    "product": "mpp",
                    "programFiles": [
                        "lib/mpp/plug.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.MPP.Plug':call/2"
                        }
                    ],
                    "repo": "https://github.com/ZenHive/mpp",
                    "vendor": "ZenHive",
                    "versions": [
                        {
                            "lessThan": "0.16.2",
                            "status": "affected",
                            "version": "0.1.0",
                            "versionType": "semver"
                        }
                    ]
                }

zenhive/mpp

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.MPP.Plug'"
                    ],
                    "packageName": "zenhive/mpp",
                    "packageURL": "pkg:github/zenhive/mpp",
                    "product": "mpp",
                    "programFiles": [
                        "lib/mpp/plug.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.MPP.Plug':call/2"
                        }
                    ],
                    "repo": "https://github.com/ZenHive/mpp",
                    "vendor": "ZenHive",
                    "versions": [
                        {
                            "lessThan": "2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b",
                            "status": "affected",
                            "version": "2d4d1d94aae7790ae0623063961adbeef171fa71",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON