Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.



 
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.





This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published: 2026-10-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Update
AI Analysis

Impact

The defect in Apache HTTP Server’s mod_session module allows a session cookie to be retained and forwarded to a backend server when an internal redirect occurs. This results in accidental exposure of session data and any associated sensitive information to an unintended party. The weakness manifests as an information‑exposure flaw (CWE‑200, CWE‑212) and could compromise user session integrity or other confidential data held within the cookie.

Affected Systems

Affected software includes the Apache Software Foundation’s Apache HTTP Server, from version 2.4.0 up through 2.4.68. Earlier releases are not implicated, and later versions where the bug has been fixed are not affected.

Risk and Exploitability

The CVSS score of 7.5 indicates a high impact on confidentiality. The likely attack vector is via client-initiated requests that trigger internal redirects, allowing an attacker with the ability to influence redirects to cause the server to forward the session cookie to a backend service. The vulnerability is not listed in the CISA KEV catalog, so no known exploits exist. Nevertheless, the potential for sensitive data leakage warrants caution.

Generated by OpenCVE AI on October 2, 2026 at 14:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or newer, where the mod_session cookie removal behavior during internal redirects has been corrected.
  • Configure the Apache configuration to explicitly remove session cookies when internal redirects occur, for example by setting the appropriate mod_session directive for SessionCookieRemove in the relevant virtual host or global context.
  • If upgrading immediately is not feasible, enforce network-level controls to block direct client access to internal backend services that may receive forwarded cookies, reducing the risk of data exposure.

Generated by OpenCVE AI on October 2, 2026 at 14:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6569-1 apache2 security update
History

Fri, 02 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-212
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Title Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Weaknesses CWE-200
References

Subscriptions

Apache Http Server
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T20:09:20.908Z

Reserved: 2026-05-19T14:41:15.957Z

Link: CVE-2026-47360

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:20.908Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T16:17:44.443

Modified: 2026-10-02T20:57:52.130

Link: CVE-2026-47360

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-01T16:00:51Z

Links: CVE-2026-47360 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:30:24Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer