CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin red...

Security readout for executives and security teams

urllib3 before 1.23 could send an Authorization header to a different host after a redirect. That can expose API tokens, bearer credentials, or basic-auth secrets to an unintended server, and may also downgrade confidentiality if the redirect changes scheme. Exposure is likely in Python applications or bundled products using urllib3 before 1.23, especially services that attach Authorization headers and follow redirects. Downstream Linux distribution packages and NetApp advisories indicate packaged deployments also required attention. Treat as a moderate credential-exposure issue. Prioritize internet-facing services, API clients, automation, and packaged appliances using affected urllib3 versions. Patch during normal security maintenance unless evidence suggests credential leakage. Mitigation focus: Upgrade urllib3 to version 1.23 or later.; Apply fixed vendor packages from relevant distribution advisories.; Review applications that send Authorization headers while following redirects..

Prepared

Jun 6, 2026, 22:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.