The vulnerability CVE-2026-47070 in benoitc hackney involves the HTTP/3 redirect handler forwarding original request headers unchanged to redirect targets without cross-origin checks. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a 3xx redirect to a different host causes these credentials to be sent verbatim to the new origin. The main hackney module has a mechanism (maybe_strip_auth_on_redirect/2) guarded by a location_trusted option to mitigate a similar issue (CVE-2018-1000007), but this protection is missing in the hackney_h3.erl module. This affects versions from 3.1.1 before 4.0.1.

Sensitive credentials such as Authorization and Cookie headers can be leaked to untrusted redirect targets during HTTP/3 redirects, potentially exposing sensitive data to malicious sites. This could lead to unauthorized access or data exposure if an attacker controls or intercepts the redirect destination. The CVSS score of 6 indicates a medium severity impact with network attack vector, low attack complexity, and partial user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling HTTP/3 redirects or the follow_redirect option when using hackney with HTTP/3 to prevent automatic forwarding of sensitive headers to untrusted origins. Monitoring vendor updates for a patch or official mitigation is recommended.