CVE-2026-113440 benoitc CVE debrief

Who should care

Defenders responsible for systems using hackney, especially those handling sensitive credentials, should verify exposure and assess the impact of potential credential interception. This includes reviewing the current version of hackney in use, assessing the exposure of sensitive credentials, and implementing additional security measures to protect credentials in transit.

Why it matters

CVE-2026-113440 vulnerability in hackney allows credential exposure via same-host redirects. Defenders should verify exposure and assess impact.

• Credential interception via same-host redirects
• Potential exposure of sensitive credentials
• Need for verification of hackney version and exposure
• Possible impact on systems handling sensitive data

Technical summary

The Insufficiently Protected Credentials vulnerability in hackney allows a redirecting server to obtain basic_auth and cookie credentials via a same-host redirect to another scheme or port. This issue affects hackney from 2.0.0 before 4.9.0. The vulnerability is caused by the library's improper handling of redirects, which can lead to the exposure of sensitive credentials. Defenders should prioritize verifying exposure in systems using hackney, especially those handling sensitive credentials, and assess the impact of potential credential interception.

Defensive priority

Defenders should prioritize verifying exposure in systems using hackney, especially those handling sensitive credentials, and assess the impact of potential credential interception.

Recommended defensive actions

• Verify the version of hackney in use and upgrade to 4.9.0 or later if necessary.
• Assess the exposure of sensitive credentials in systems using hackney.
• Implement additional security measures to protect credentials in transit.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions requires further verification. The hackney library's handling of redirects and credentials is a critical aspect that needs to be examined. Defenders should verify the version of hackney in use and assess the exposure of sensitive credentials in systems using this library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.