Bug 2499147

Summary: CVE-2026-59180 python-apprise: Apprise: Information disclosure via HTTP redirect following with credential resending [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Jon Weiser <jweiser>
Component: python-appriseAssignee: Chris Caron <lead2gold>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: epel10CC: lead2gold
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["a5524bdd-9d4f-45bf-8757-4cac93e9f73a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-07-12 01:22:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2499082    

Description Jon Weiser 2026-07-10 19:51:48 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.
Comment 1 Chris Caron 2026-07-12 01:22:57 UTC 
This is correct; but this isn't a bug. The version protected by (and/or corrects the) CVE has been already deployed on Fedora; v1.11.0

Reguardless, I pushed v1.12.0 recently to stay even further ahead. See https://src.fedoraproject.org/rpms/python-apprise/c/22dbf00186ceb99250ae7e93c769325bb4b4d64e?branch=rawhide.