CVE-2026-66339 is a vulnerability in libsoup where, after an HTTP CONNECT tunnel is established through a proxy, the Proxy-Authorization header is erroneously attached to subsequent HTTPS requests sent through the tunnel to the destination server. This behavior allows the destination server to capture proxy credentials, resulting in sensitive information disclosure. The vulnerability affects Red Hat Enterprise Linux 10. No explicit affected versions or patch information is provided in the available data. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

The vulnerability allows an attacker controlling or impersonating the destination server to obtain proxy credentials that should remain confidential. This leads to information disclosure of sensitive proxy authentication data. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66339 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply any official patches once available.