CVE-2026-66822: CWE-201: Insertion of Sensitive Information Into Sent Data in Microsoft .NET 10.0

This vulnerability (CWE-201) in Microsoft .NET's System.Net.Http occurs because the SocketsHttpHandler can retain and send the Proxy-Authorization header during HTTP redirects, which can cause sensitive proxy credentials to be leaked to the redirected destination server. The vulnerability affects multiple runtime packages across various platforms and architectures. The CVSS 3.1 score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Official patches have been released to fix this issue in affected versions.

The vulnerability can lead to the unintended disclosure of sensitive proxy credentials (basic authentication) to destination servers following HTTP redirects. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Microsoft has released official fixes for this vulnerability. Users and developers should update affected Microsoft .NET runtime packages to the patched versions listed by Microsoft to remediate the issue. No additional mitigation steps are required beyond applying the official updates.