CVE-2026-48595 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-48595HIGH

elixir-tesla tesla — Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   N   N    8.2   .0049   40.0     —

AFFECTED
  Product  Versions                                    Fixed
  tesla    1.4.0 –                                     —
  tesla    2d937d5813d7cda5cd726f41824985fb655c920f –  —

TIMELINE
  May 22  Reserved by EEF
  Jun 2   EXPLOIT PUBLISHED — CVE-2026-48595 (elixir-tesla tesla). Public exploit reference added.
  Jun 2   Published (CNA: EEF)

CWE-178 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin redirects. Tesla.Middleware.FollowRedirects strips security-sensitive headers on cross-origin redirects using a case-sensitive string comparison against a lowercase filter list (@filter_headers ["authorization", "host"]). HTTP header names are case-insensitive per RFC 7230, but Tesla preserves header keys verbatim as supplied by the caller without normalizing case. A header set as {"Authorization", "Bearer …"} (the RFC 7235 canonical casing used by virtually all HTTP libraries and documentation) does not match the lowercase filter entry and is forwarded to the redirect destination. An attacker who can control or influence a Location: response seen by the client (via their own endpoint, a redirect-open upstream, or a compromised origin) receives the bearer token or other Authorization material on the cross-origin request. This issue affects tesla: from 1.4.0 before 1.18.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 22, 2026	Reserved	Reserved by EEF
June 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48595 (elixir-tesla tesla). Public exploit reference added.
June 2, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
elixir-tesla	tesla	—	1.4.0	—
elixir-tesla	tesla	—	2d937d5813d7cda5cd726f41824985fb655c920f	—

Weaknesses

CWE-178

References (4)

https://cna.erlef.org/cves/CVE-2026-48595.html [Third Party Advisory]
https://github.com/elixir-tesla/tesla/commit/db963dba67651b9abd1fc420a1d9679cf6efe182 [Patch]
https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m [Vendor Advisory, Exploit]
https://osv.dev/vulnerability/EEF-CVE-2026-48595 [Third Party Advisory]

Authoritative record: CVE-2026-48595 at cve.org

Vendors: elixir-tesla

Weaknesses: CWE-178

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-48595 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.