VulnerabilityPublished 07/24/2026

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Affects hubuum_clientSource GCVE Database

Severity

Medium

Rated by Threat Radar

Patch: Available – fixed in 0.6.1

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What to do

AI-suggested

A fixed version 0.6.1 of the Hubuum client library disables automatic redirect following by setting reqwest's redirect policy to none, causing 3xx responses to be returned as errors instead of followed. Users of affected versions (>=0.0.1 <0.6.1) should upgrade to 0.6.1 or later. Alternatively, users can construct a reqwest client with redirect policy set to none and supply it explicitly to the Hubuum client. Deployments should also ensure the Hubuum origin is not shared with other applications and that trusted infrastructure does not redirect API requests outside the configured path prefix to reduce exposure.

Affected software

Product	Affected	Fixed in
crates.iohubuum_client	Affected >=0.0.1 <0.6.1	Fixed in 0.6.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The Hubuum client library for Rust versions from 0.0.1 up to but not including 0.6.1 has a vulnerability where authenticated requests may leak the bearer Authorization header outside the configured base path due to how HTTP redirects are handled. The library uses reqwest's default redirect policy, which retains sensitive headers on redirects within the same origin but different paths. An attacker or compromised intermediary influencing a 3xx redirect response could cause the Authorization header to be sent to unintended paths on the same origin. This does not affect cross-origin redirects. The issue is fixed in version 0.6.1 by disabling automatic redirect following. Workarounds include configuring reqwest clients to disable redirects and ensuring the Hubuum origin is not shared with other applications that could redirect requests outside the allowed path prefix.

Summary

The Hubuum Rust client library prior to version 0.6.1 uses reqwest's default redirect policy, which allows automatic following of HTTP 3xx redirects while retaining sensitive headers such as the bearer Authorization token if the redirect is within the same scheme, host, and port but changes the path. Although the BaseUrl setting constrains initial requests to a configured origin and path prefix, redirect processing occurs after this validation, allowing a redirect to a different path on the same origin to leak the Authorization header outside the intended API path. Exploitation requires an attacker, compromised server, or intermediary to influence a redirect response. Version 0.6.1 mitigates this by configuring reqwest clients with redirect policy set to none, returning 3xx responses as errors instead of following them automatically. Users can also opt-in to custom clients with different redirect policies. This vulnerability is tracked as GHSA-f45q-w629-wr25 and has a moderate severity rating.

Impact

Sensitive bearer Authorization headers may be leaked to unintended paths on the same origin due to automatic following of HTTP redirects that change only the path. This could expose authentication tokens to endpoints outside the configured Hubuum API path prefix, potentially leading to unauthorized access or information disclosure. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes. Exploitation requires control or influence over redirect responses.

Weaknesses

CWE-200Information Exposure (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:52:16 UTC

Technical details

Weaknesses

References

Related threats