CVE-2026-44503: Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
(updated )
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.
This vulnerability is present in the RedirectHandlers for:
https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go
References
- github.com/advisories/GHSA-7j59-v9qr-6fq9
- github.com/microsoft/kiota-java
- github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9
- github.com/pypa/advisory-database/tree/main/vulns/microsoft-kiota-http/PYSEC-2026-2647.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-44503
- pypi.org/project/microsoft-kiota-http
Code Behaviors & Features
Detect and mitigate CVE-2026-44503 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →