CVE-2026-107399: Mechanize sends credential headers to another origin after a meta refresh
mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanize#request_headers= followed a refresh that pointed at another origin.
References
- github.com/advisories/GHSA-c6rp-p8xm-4q9f
- github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f
- github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3
- github.com/sparklemotion/mechanize/pull/676
- github.com/sparklemotion/mechanize/releases/tag/v2.14.1
- github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f
- nvd.nist.gov/vuln/detail/CVE-2026-107399
Code Behaviors & Features
Detect and mitigate CVE-2026-107399 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →