{"id":"GHSA-f45q-w629-wr25","aliases":[],"status":"published","title":"Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects","description":"## Impact\n\nThe built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path prefix.\n\nExploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.\n\n## Patches\n\nVersion 0.6.1 configures both built-in HTTP clients with `reqwest::redirect::Policy::none()`. Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.\n\n## Workarounds\n\nOn affected versions, construct a reqwest client with `reqwest::redirect::Policy::none()` and pass it through `with_http_client`. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-07-24T21:48:36Z","modified":"2026-07-24T22:00:26Z","fixes":[{"ecosystem":"crates.io","package":"hubuum_client","fixed_in":["0.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hubuum_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hubuum_client","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1"},{"fixed":"0.6.1"}]}]}],"references":[{"url":"https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-f45q-w629-wr25","tags":["web"]},{"url":"https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f45q-w629-wr25"},{"url":"https://github.com/hubuum/hubuum-client-rust","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f45q-w629-wr25","title":"Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects","description":"## Impact\n\nThe built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path prefix.\n\nExploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.\n\n## Patches\n\nVersion 0.6.1 configures both built-in HTTP clients with `reqwest::redirect::Policy::none()`. Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.\n\n## Workarounds\n\nOn affected versions, construct a reqwest client with `reqwest::redirect::Policy::none()` and pass it through `with_http_client`. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.","status":"published","published":"2026-07-24T21:48:36Z","modified":"2026-07-24T21:48:39Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"osv":[{"id":"GHSA-f45q-w629-wr25","title":"Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects","description":"## Impact\n\nThe built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path prefix.\n\nExploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.\n\n## Patches\n\nVersion 0.6.1 configures both built-in HTTP clients with `reqwest::redirect::Policy::none()`. Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.\n\n## Workarounds\n\nOn affected versions, construct a reqwest client with `reqwest::redirect::Policy::none()` and pass it through `with_http_client`. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.","status":"published","published":"2026-07-24T21:48:36Z","modified":"2026-07-24T22:00:26.904951923Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}