CVE-2018-20060: Exposure of Sensitive Information in urllib3
Summary
CVE-2018-20060: Exposure of Sensitive Information to an Unauthorized Actor in urllib3. Affects urllib3 versions < 1.23. Fixed in 1.23. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2018-20060 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
urllib3 is a Python library that provides a high-level interface for making HTTP requests. It is widely used in various Python applications and frameworks. urllib3 allows users to send HTTP requests, handle redirects, and manage connection pooling. However, versions prior to 1.23 have a vulnerability that exposes sensitive information to unauthorized actors when following a cross-origin redirect. This vulnerability can result in the exposure of credentials transmitted in cleartext or to unintended hosts.
Vulnerability Detail
The vulnerability in urllib3 arises from the failure to remove the Authorization HTTP header when following a cross-origin redirect. This means that if a redirect occurs to a different host, port, or scheme, the Authorization header, which may contain sensitive credentials, will be included in the redirected request. As a result, these credentials can be exposed to unintended hosts or transmitted without encryption. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.23
This is the first release that contains the fix.
pip install --upgrade "urllib3==1.23"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a possible workaround is to manually remove the Authorization header before making the redirected request. This can be done by modifying the code that handles the redirect and removing the header from the request headers. Here is an example of how to remove the Authorization header using the requests library:
import requests
response = requests.get(url, allow_redirects=False)
if response.status_code == 302:
headers = response.headers
if 'Authorization' in headers:
del headers['Authorization']
redirected_response = requests.get(response.headers['Location'], headers=headers)
Conclusion
The vulnerability in urllib3 exposes sensitive information to unauthorized actors when following cross-origin redirects. To mitigate this risk, it is crucial to upgrade urllib3 to version 1.23 or later. Alternatively, the Authorization header can be manually removed from redirected requests as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
This vulnerability can lead to the exposure of sensitive credentials transmitted in cleartext or to unintended hosts. Attackers who can intercept network traffic or gain access to logs may be able to obtain these credentials and potentially compromise user accounts or gain unauthorized access to systems.
While there is no specific known exploit for this vulnerability, it is important to address it promptly to prevent potential exposure of sensitive information. Attackers with knowledge of this vulnerability could attempt to exploit it to gain unauthorized access to systems or user accounts.
No, only versions prior to 1.23 are affected by this vulnerability. It is recommended to upgrade to the latest version to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send a malicious request that triggers a cross-origin redirect, leading to the exposure of sensitive information.
Yes, this vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
