CVE-2026-48595

Estado: ModificadaAlta (8.2)—

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.

Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case.

Leer descripción completaMostrar menos

A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.

This issue affects tesla: from 1.4.0 before 1.18.3.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.67%
Percentil entre todas las CVEs puntuadas: 50
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1552.007 Container APIcredential access90 %
Impacto secundarioT1598.003 Spearphishing Linkreconnaissance75 %

Vulnerabilidad de red sin autenticación (AV:N, PR:N, UI:N) en biblioteca HTTP. Impacto: fuga de credenciales (Authorization header) en redirecciones cross-origin por comparación case-sensitive; riesgo de phishing del token robado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Limit Access to Resource Over Network Vulnerability Scanning User Training User Account Management

Tecnologías afectadas (1)

Elixir-tesla — Tesla

CWE

CWE-178

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-48595",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48595",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T15:59:45.683092Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "modules": [
            "'Elixir.Tesla.Middleware.FollowRedirects'"
          ],
          "product": "tesla",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0",
              "lessThan": "1.18.3",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/tesla",
          "packageName": "tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "modules": [
            "'Elixir.Tesla.Middleware.FollowRedirects'"
          ],
          "product": "tesla",
          "versions": [
            {
              "status": "affected",
              "version": "2d937d5813d7cda5cd726f41824985fb655c920f",
              "lessThan": "db963dba67651b9abd1fc420a1d9679cf6efe182",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "packageName": "elixir-tesla/tesla",
          "programFiles": [
            "lib/tesla/middleware/follow_redirects.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Tesla.Middleware.FollowRedirects':call/3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T20:16:38.390",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-48595.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-tesla/tesla/commit/2d937d5813d7cda5cd726f41824985fb655c920f",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182",
      "tags": [
        "Patch"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48595",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects.\n\nTesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers [\"authorization\", \"host\"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {\"Authorization\", \"Bearer …\"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request.\n\nThis issue affects tesla: from 1.4.0 before 1.18.3."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de manejo inadecuado de la distinción entre mayúsculas y minúsculas en elixir-tesla tesla permite la fuga de credenciales a un origen de terceros en redirecciones de origen cruzado.\n\nTesla.Middleware.FollowRedirects elimina encabezados sensibles a la seguridad en redirecciones de origen cruzado utilizando una comparación de cadenas que distingue entre mayúsculas y minúsculas contra una lista de filtros en minúsculas (@filter_headers ['authorization', 'host']). Los nombres de los encabezados HTTP no distinguen entre mayúsculas y minúsculas según la RFC 7230, pero Tesla conserva las claves de los encabezados textualmente tal como las proporciona el llamador sin normalizar las mayúsculas y minúsculas. Un encabezado establecido como {'Authorization', 'Bearer ...'} (la capitalización canónica de la RFC 7235 utilizada por prácticamente todas las bibliotecas y documentación HTTP) no coincide con la entrada del filtro en minúsculas y se reenvía al destino de la redirección. Un atacante que puede controlar o influir en una respuesta Location: vista por el cliente (a través de su propio punto final, un upstream de redirección abierta o un origen comprometido) recibe el token de portador u otro material de autorización en la solicitud de origen cruzado.\n\nEste problema afecta a tesla: desde 1.4.0 antes de 1.18.3."
    }
  ],
  "lastModified": "2026-09-24T21:17:13.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A796038-A843-4B88-83C9-22493F7482B0",
              "versionEndExcluding": "1.18.3",
              "versionStartIncluding": "1.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}