Bug 2506951 (CVE-2026-66339)

Summary: CVE-2026-66339 libsoup: libsoup: Proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-24 22:29:43 UTC 
After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This means the destination server receives proxy credentials in cleartext (within the TLS session). Per HTTP standards, Proxy-Authorization should only appear on the CONNECT request itself, never on requests forwarded through the established tunnel. The proxy authentication logic in auth_msg_starting() in libsoup/auth/soup-auth-manager.c runs unconditionally for all messages without checking whether the current request is being sent through an already-established CONNECT tunnel. This is distinct from CVE-2026-12547 which covers credential leak on proxy switch.

Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/534
PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666