CVE-2026-12547 | SoupAuthManager caches proxy authentication credentials with… | CVSS 3.4 LOW

Description

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.

Metadata

CVE ID: CVE-2026-12547
State: PUBLISHED
Assigner: redhat
Reserved: 2026-06-17 18:09 UTC
Published: 2026-07-21 18:35 UTC
Last updated: 2026-07-21 19:14 UTC
Primary CWE: CWE-201
Insertion of Sensitive Information Into Sent Data
Vendor / Product: Red Hat / Red Hat Enterprise Linux 10
Sources: cve.org · NVD

Severity & Metrics

3.4 LOW CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Red Hat	Red Hat Enterprise Linux 10	—	—

Weakness (CWE)

CWE	Source	Description
CWE-201	cna	Insertion of Sensitive Information Into Sent Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
3.4	LOW	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

References (3)