The vulnerability involves SoupAuthManager caching proxy authentication credentials globally rather than scoping them to the specific proxy authority. When the system's proxy configuration changes, such as through system settings or WPAD, the cached Proxy-Authorization headers from the previous proxy are sent to the new proxy. This behavior can lead to the unintended disclosure of sensitive authentication credentials to an unauthorized proxy. The CVSS 3.1 base score is 3.4 (low), reflecting network attack vector, low complexity, high privileges required, user interaction required, scope changed, and limited confidentiality impact. The vendor advisory does not specify a remediation or patch status.

The impact is limited to the potential leakage of proxy authentication credentials to an unintended proxy server when proxy settings change. This could allow an attacker controlling the new proxy to obtain sensitive credentials. There is no impact on integrity or availability. The vulnerability requires high privileges and user interaction, reducing exploitation likelihood. No known exploits have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12547 for current remediation guidance. Until an official fix is available, users should carefully manage proxy configurations and avoid frequent or automatic proxy changes that could trigger credential leakage. Monitor vendor updates for patches or workarounds.