CVE-2026-67354 guzzle CVE debrief

Who should care

Defenders and developers using Guzzle versions before 7.15.1 should assess their exposure and prioritize remediation efforts. This includes verifying the Guzzle version, reviewing and adjusting the allow_redirects.referer setting, and monitoring for potential exploitation attempts. Additionally, security teams and vulnerability management teams should be aware of the potential impact on their systems and take necessary actions to mitigate the vulnerability

Why it matters

Defenders should care about CVE-2026-67354 because it discloses sensitive client data in Guzzle versions before 7.15.1. The vulnerability is related to the RedirectMiddleware and the optional allow_redirects.referer setting. Exploitation requires control of the redirect destination and can lead to disclosure of sensitive information. Defenders and developers using affected Guzzle versions should assess their exposure, prioritize remediation, and verify their Guzzle version and setting configurations.

• Potential disclosure of one-time login secrets, access tokens, state values, or other sensitive client data
• Possible exploitation by an attacker who controls the redirect destination
• Need for verification of Guzzle version and allow_redirects.referer setting in applications

Technical summary

Guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the generated Referer header when following a same-scheme redirect. This can lead to the disclosure of sensitive client data, such as one-time login secrets, access tokens, state values, or other sensitive information. The vulnerability requires control of the redirect destination and can be exploited by an attacker. Fixed in 7.15.1, which strips the fragment before generating the Referer value.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their systems, especially those using Guzzle versions before 7.15.1.

Recommended defensive actions

• Verify Guzzle version and upgrade to 7.15.1 or later if necessary
• Review and adjust the allow_redirects.referer setting in your application
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the information disclosure vulnerability in Guzzle versions before 7.15.1. The vulnerability is related to the RedirectMiddleware and the optional allow_redirects.referer setting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.