Description
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.
Published: 2026-10-08
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure via credential leakage
Action: Immediate patch
AI Analysis

Impact

Mechanize, a Ruby library for web automation, mishandled redirects before version 2.14.1. When a redirect stays on the same host but changes the scheme or port, the library considers it the same origin and continues to send stored Authorization and Cookie headers for the request. This behavior allows an attacker to cause credentials to be transmitted over an unsecured HTTP connection or to a different service listening on another port, exposing secrets without affecting integrity or availability.

Affected Systems

The vulnerable product is the Mechanize library from Sparklemotion. All releases before 2.14.1 are affected; the fix was released in version 2.14.1.

Risk and Exploitability

The CVSS score of 5.9 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying no known widespread exploitation yet. A likely attack vector involves an application that follows redirects automatically and includes credentials; an attacker can inject a redirect that points to an HTTP URL or to a different port, causing the library to leak stored credentials to an unintended destination. The impact is limited to confidentiality loss.

Generated by OpenCVE AI on October 9, 2026 at 02:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Mechanize library to version 2.14.1 or later to apply the vendor fix.
  • If an upgrade is not possible, configure the agent to disable automatic redirect following or to validate that redirects match the original scheme and port before resending credentials.
  • Restrict the use of Authorization and Cookie headers to HTTPS endpoints and avoid sending them to non‑trusted services.

Generated by OpenCVE AI on October 9, 2026 at 02:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Sparklemotion
Sparklemotion mechanize
Vendors & Products Sparklemotion
Sparklemotion mechanize

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-346
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.
Title Mechanize sends credential headers to a different scheme or port after a redirect
Weaknesses CWE-200
CWE-319
CWE-522
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Sparklemotion Mechanize
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-09T15:06:49.265Z

Reserved: 2026-10-08T17:21:52.975Z

Link: CVE-2026-107714

cve-icon Vulnrichment

Updated: 2026-10-09T15:06:45.880Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T22:17:27.003

Modified: 2026-10-09T16:38:57.820

Link: CVE-2026-107714

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-08T21:26:16Z

Links: CVE-2026-107714 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:03:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-319

    Cleartext Transmission of Sensitive Information

  • CWE-346

    Origin Validation Error

  • CWE-522

    Insufficiently Protected Credentials