CVE-2026-1539: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-1539 is a credential leakage vulnerability in the libsoup HTTP library that causes proxy authentication credentials to be transmitted to unintended third-party servers during HTTP redirects. When a request is redirected to a different host, libsoup correctly removes the Authorization header but fails to strip the Proxy-Authorization header, exposing sensitive proxy credentials. The vulnerability affects GNOME libsoup and is present across Red Hat Enterprise Linux versions 6.0 through 10.0. It was published on January 28, 2026, with a patch available as of March 25, 2026. It carries a CVSS v3.1 base score of 5.8 (Medium) (Red Hat CVE, GNOME GitLab).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). During HTTP redirect handling, libsoup implements logic to strip the Authorization header when a request is forwarded to a different host — a standard security practice to prevent credential forwarding — but this logic does not extend to the Proxy-Authorization header. As a result, any application using libsoup that authenticates through an HTTP proxy may inadvertently forward proxy credentials to a third-party server if a redirect to a different host is encountered. The attack vector is network-based, requires no privileges or user interaction, and has a changed scope because the impact extends beyond the vulnerable component to the proxy infrastructure (Red Hat CVE, GNOME GitLab).

Successful exploitation results in the unintentional disclosure of proxy authentication credentials (usernames and passwords encoded in the Proxy-Authorization header) to attacker-controlled or otherwise unintended third-party servers. The impact is limited to confidentiality — there is no integrity or availability impact — but the leaked credentials could be used to authenticate to the proxy, enabling further network access or lateral movement within environments where the proxy controls internal resource access. All applications using libsoup for HTTP communication in GNOME environments and Red Hat Enterprise Linux 6.0–10.0 are potentially affected (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). No threat actor attribution has been identified. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to control or influence HTTP redirect destinations, such as through a man-in-the-middle position or a malicious server that issues cross-host redirects.

1. Set up a malicious redirect server: Deploy an HTTP server that, upon receiving a request, responds with a 301/302 redirect pointing to a different host (attacker-controlled or third-party).
2. Position the target: Ensure a victim application using libsoup is configured to use an HTTP proxy with authentication (i.e., Proxy-Authorization header is set) and will make requests to the attacker's server or a server the attacker can influence.
3. Trigger the redirect: Cause the libsoup-based application to send an HTTP request to the initial server (e.g., via a crafted URL, SSRF, or social engineering).
4. Capture the Proxy-Authorization header: The redirect response causes libsoup to re-issue the request to the new host while retaining the Proxy-Authorization header. The attacker's redirect destination server receives the request including the proxy credentials.
5. Extract and abuse credentials: Parse the Proxy-Authorization header from the received request to obtain the Base64-encoded proxy username and password, then use them to authenticate to the proxy for further network access (GNOME GitLab, Red Hat CVE).

• Network: HTTP requests to unexpected external hosts containing a Proxy-Authorization header, particularly following a redirect chain; cross-host HTTP redirects (301/302) observed in proxy or application logs where the destination host differs from the original.
• Logs: Application or proxy logs showing Proxy-Authorization headers forwarded to hosts outside the expected domain; unusual redirect chains in HTTP access logs involving different hostnames.
• Process/Application: libsoup-based applications (e.g., GNOME applications, GNOME Online Accounts, Evolution) making outbound connections to unexpected hosts after following redirects.

A patch for libsoup was made available on March 25, 2026, via the GNOME project (GNOME GitLab). Users should update libsoup to the patched version on all affected systems, including Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, and 10.0, as well as Ubuntu (USN-8020-1), openSUSE, Fedora, and SUSE distributions that have issued advisories (Ubuntu Advisory, openSUSE). As a workaround where patching is not immediately possible, consider disabling proxy authentication for libsoup-based applications, implementing network controls to block unexpected cross-host redirects, or monitoring proxy logs for anomalous Proxy-Authorization forwarding.

Multiple Linux distributions including Ubuntu, openSUSE, SUSE, and Fedora issued security advisories and updates for libsoup following disclosure (Ubuntu Advisory, openSUSE). The Yocto Project security mailing list also tracked the vulnerability for embedded Linux environments (Yocto Security). Dell issued a security advisory (DSA-2026-214) referencing the vulnerability in its products (Dell Advisory). Community coverage was largely focused on patch availability and upgrade guidance rather than active exploitation concerns.