GHSA-qqc3-94qv-7fw3: Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

July 24, 2026

When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams.

References

github.com/advisories/GHSA-qqc3-94qv-7fw3
github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50
github.com/hubuum/hubuum-client-rust/releases/tag/v0.6.1
github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-qqc3-94qv-7fw3

Code Behaviors & Features

Detect and mitigate GHSA-qqc3-94qv-7fw3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →