AIKIDO-2026-10812

urllib3-future is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized ActorCVE-2026-44431 Published May 14, 2026

High Risk

This Affects:

urllib3-future

2.0.931 - 2.19.913

Fixed in 2.20.900

Are you affected? Scan for Free

TL;DR

Affected versions of urllib3-future may forward sensitive headers such as Authorization, Cookie, and Proxy-Authorization during cross-origin redirects when using certain low-level proxy APIs. This can result in credential leakage to unintended external hosts.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

urllib3-future is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 2.0.931 - 2.19.913.

How to fix this

Upgrade the urllib3-future library to the patch version. If upgrading is not possible, avoid using ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) for cross-origin redirects and use ProxyManager.request() instead where applicable.