linuxfabrik-lib implements a fetch helper that follows redirects always. Prior to version 6.0.0 it forwarded any credential header the caller supplied, except for Authorization and Cookie, across those redirects. Consequently a monitoring system that uses lib.url.fetch to contact a protected service could unintentionally expose headers such as X-Auth-Token to an attacker if that service redirects the request to a malicious host. The exposed credentials give an attacker full access to the monitored system as if they were the original client.

The issue affects Linuxfabrik monitoring‑plugins that include linuxfabrik-lib older than version 6.0.0. Any deployment that calls lib.url.fetch with sensitive headers and whose destination can send an HTTP redirect will be vulnerable.

The CVSS score of 6.0 marks the vulnerability as moderate. The EPSS score of less than 1 % indicates that the likelihood of exploitation in the wild is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The typical attack vector is a server under attacker control that returns an HTTP redirect; if the client’s request is automatically followed, the attacker’s server receives the forwarded headers. An attacker could use this mechanism to harvest authentication tokens or other privileged data embedded in non‑Authorization headers.