All vulnerabilities
CVE-2026-107399GHSA-c6rp-p8xm-4q9f

Mechanize sends credential headers to another origin after a meta refresh

sparklemotion mechanizerubygemsLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.14.1Fixed versionGitHub
Published8 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 2.14.1mechanize, rubygemsGitHub
  • 2.14.1mechanize, RubyGemsOSVbundle update mechanize --conservative # needs 2.14.1 or later

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanize#request_headers= followed a refresh that pointed at another origin.

Details

Mechanize::HTTP::Agent#response_follow_meta_refresh fetched the refresh target with no notion of a crossed origin, so @request_headers were re-applied in full. An attacker who could place a meta refresh in a page the agent fetched — through stored content, an open redirect, or control of any page in the crawl — collected the same credentials as through an HTTP redirect, on a code path that had none of the redirect path's protections.

The refresh fetch passes an empty per-request headers hash, so only headers set through Mechanize#request_headers= were exposed.

This requires Mechanize#follow_meta_refresh = true. It is false by default, so an agent in its default configuration is not affected. Crawlers commonly enable it.

Impact

An attacker who can place a meta refresh in any page the agent fetches captures bearer tokens and session cookies set through request_headers=. Disclosure only; no integrity or availability impact.

Patches

Fixed in mechanize v2.14.1. A meta refresh that points at another origin is now subject to the same rule as an HTTP redirect: credentials and cookies are withheld from the request that follows it.

Workarounds

Leave Mechanize#follow_meta_refresh at its default of false, or avoid request_headers= for credentials when it is enabled.

Text from GitHub Advisory Database

Affected versions 53

  • mechanize, rubygems< 2.14.1GitHub
  • mechanizeaffected: < 2.15.0CVE List
  • mechanize, RubyGemsfrom first release, fixed in 2.14.1OSV
  • mechanize, RubyGems0.1.0OSV
  • mechanize, RubyGems0.1.1OSV
  • mechanize, RubyGems0.1.2OSV
  • mechanize, RubyGems0.1.3OSV
  • mechanize, RubyGems0.2.0OSV
  • mechanize, RubyGems0.2.1OSV
  • mechanize, RubyGems0.2.2OSV
  • mechanize, RubyGems0.2.3OSV
  • mechanize, RubyGems0.3.0OSV
  • mechanize, RubyGems0.3.1OSV
  • mechanize, RubyGems0.4.0OSV
  • mechanize, RubyGems0.4.1OSV
  • mechanize, RubyGems0.4.2OSV
  • mechanize, RubyGems0.4.3OSV
  • mechanize, RubyGems0.4.4OSV
  • mechanize, RubyGems0.4.5OSV
  • mechanize, RubyGems0.4.6OSV
  • mechanize, RubyGems0.4.7OSV
  • mechanize, RubyGems0.5.0OSV
  • mechanize, RubyGems0.5.1OSV
  • mechanize, RubyGems0.5.2OSV
  • mechanize, RubyGems0.5.3OSV
  • mechanize, RubyGems0.5.4OSV
  • mechanize, RubyGems0.6.0OSV
  • mechanize, RubyGems0.6.1OSV
  • mechanize, RubyGems0.6.10OSV
  • mechanize, RubyGems0.6.11OSV
  • mechanize, RubyGems0.6.2OSV
  • mechanize, RubyGems0.6.3OSV
  • mechanize, RubyGems0.6.4OSV
  • mechanize, RubyGems0.6.5OSV
  • mechanize, RubyGems0.6.6OSV
  • mechanize, RubyGems0.6.7OSV
  • mechanize, RubyGems0.6.8OSV
  • mechanize, RubyGems0.6.9OSV
  • mechanize, RubyGems0.7.0OSV
  • mechanize, RubyGems0.7.1OSV
  • mechanize, RubyGems0.7.2OSV
  • mechanize, RubyGems0.7.3OSV
  • mechanize, RubyGems0.7.4OSV
  • mechanize, RubyGems0.7.5OSV
  • mechanize, RubyGems0.7.6OSV
  • mechanize, RubyGems0.7.7OSV
  • mechanize, RubyGems0.7.8OSV
  • mechanize, RubyGems0.8.0OSV
  • mechanize, RubyGems0.8.1OSV
  • mechanize, RubyGems0.8.2OSV
  • mechanize, RubyGems0.8.3OSV
  • mechanize, RubyGems0.8.4OSV
  • mechanize, RubyGems0.8.5OSV

References 6