CVE-2026-46391: HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

May 19, 2026 (updated June 9, 2026)

Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.

References

github.com/advisories/GHSA-4fg7-f244-3j49
github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49
nvd.nist.gov/vuln/detail/CVE-2026-46391

Code Behaviors & Features

Detect and mitigate CVE-2026-46391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →