CVE-2026-48856: Erlang OTP httpc Credential Leakage via Cross-Origin Redirects

Technical summary

The vulnerability exists in the httpc_response:redirect/2 function within Erlang OTP's inets HTTP client library. When constructing a redirected request, the code updates only the Host header field while copying all other headers verbatim to the new request. Critically, the function does not validate whether the redirect target shares the same origin as the original request. This permits cross-origin credential leakage: a victim application making an authenticated request to an attacker-controlled server receives a 3xx redirect to another attacker-controlled domain, and httpc blindly forwards the Authorization header (potentially containing Basic auth credentials parsed from URL userinfo) and Proxy-Authorization header to the redirect destination. The httpc_request:handle_user_info/2 function derives Basic credentials from URL userinfo fields, which are then included in subsequent headers and forwarded across origins during redirect.

Business impact

Any service or application using Erlang OTP's httpc client for outbound HTTP requests is at risk of credential exposure if those requests are directed toward untrusted or compromised endpoints. The exposure occurs transparently—developers are unlikely to realize that credentials embedded in URLs or configured for proxy authentication are being leaked to redirect targets. For organizations relying on Erlang-based microservices, message brokers (e.g., RabbitMQ), or distributed systems using httpc for inter-service or external API communication, a single malicious redirect can expose service-to-service authentication tokens, proxy credentials, or user-supplied credentials. This is particularly dangerous in environments where HTTP Basic Auth or credentials-in-URLs remain common practices.

Affected systems

Erlang OTP versions 17.0 through 29.0.1 are affected, with three patched versions: 29.0.2, 28.5.0.2, and 27.3.4.13. The corresponding inets library versions are 5.10 through 9.7.0, with patches available in inets 9.7.1, 9.6.2.2, and 9.3.2.6. Any application built on or embedding Erlang/OTP in this range using httpc for HTTP client operations—including frameworks, message queues, and distributed systems—may be vulnerable if they do not explicitly set the autoredirect option to false or if they use default settings.

Exploitability

Exploitation requires a victim application to make an httpc request to an attacker-controlled server, which then issues a cross-origin redirect. The attack requires no user interaction (UI:N in CVSS), authenticated context (the victim must be making authenticated requests), and network-level access to respond with a malicious redirect. The barrier to exploitation is low for an attacker operating a compromised or malicious endpoint, making this a practical attack vector in supply-chain scenarios, DNS hijacking, or network-level compromise. However, the authenticated request context (PR:L) means the victim application must be making requests with credentials in the first place, limiting scope to applications that use credential-based authentication.

Remediation

Upgrade Erlang OTP to version 29.0.2 or later, or apply the targeted patches for earlier versions: OTP 28.5.0.2 and 27.3.4.13. These patches modify httpc_response:redirect/2 to validate that redirect targets share the same origin (scheme, host, port) as the original request, and to strip Authorization and Proxy-Authorization headers when crossing origin boundaries. For applications unable to patch immediately, disable automatic redirects by setting the autoredirect option to false in httpc configuration and handle redirects explicitly in application logic with origin validation.

Patch guidance

Verify your Erlang OTP version with erl -version. If running OTP 29.0.1 or earlier (except patched versions 29.0.2, 28.5.0.2, or 27.3.4.13), upgrade immediately. Patch testing should focus on verifying that legitimate cross-origin redirects are now blocked and that intra-origin redirects continue to function. Regression testing is minimal, as the fix only restricts behavior; applications relying on credential forwarding across origins will need explicit code changes to handle redirects manually. Vendors distributing embedded Erlang (e.g., message brokers, telephony platforms) should prioritize patching releases containing affected OTP versions.

Detection guidance

Monitor httpc or HTTP client logs for redirect (3xx) responses, particularly from external or untrusted domains. Correlate outbound authenticated requests with subsequent requests to different origins. Network-level detection is challenging without application instrumentation, but DNS monitoring or proxy logs showing credential headers in requests to unexpected origins may surface exploitation. For proactive assessment, scan application dependencies to identify Erlang OTP versions and validate that either (a) httpc is not used, (b) autoredirect is explicitly disabled, or (c) OTP has been patched. Code review should identify httpc:request/N calls without explicit autoredirect configuration.

Why prioritize this

Although rated MEDIUM (CVSS 6.5), this vulnerability merits high prioritization for organizations using Erlang. The flaw is in core infrastructure—the default HTTP client—affecting all httpc users transparently. Credential exposure is not ephemeral or theoretical; it directly enables account takeover, lateral movement, or supply-chain compromise. The default-enabled autoredirect setting means affected organizations are vulnerable without any misconfiguration; the burden is on patching, not remediation. Additionally, detecting exploitation is difficult and may go unnoticed. For applications already using service-to-service authentication or talking to external APIs, this is a direct path to credential compromise.

Risk score, explained

The CVSS 6.5 MEDIUM rating reflects the authenticated context (PR:L) required to trigger the flaw—the victim application must already be making authenticated requests. However, the impact is HIGH confidentiality loss (C:H) for credential data, with no integrity or availability impact (I:N, A:N). The attack vector is network-based (AV:N) with low attack complexity (AC:L) once a server is compromised or controlled. The rating does not fully capture organizational risk, because in practice, many Erlang deployments handle critical inter-service communication over HTTP, making credential leakage highly damaging despite the authenticated precondition.

Frequently asked questions