Description
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| microsoft | kiota-java | < 1.9.1 | — |
| microsoft | Microsoft.Kiota.Abstractions | < 1.22.0 | — |
| microsoft | github.com/microsoft/kiota-http-go | < 1.5.5 | — |
| microsoft | kiota-typescript | < 1.0.0-preview.100 | — |
| microsoft | microsoft-kiota-abstractions | < 1.9.1 | — |
| microsoft | microsoft-kiota-http | < 1.9.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | azure-service-operator | 2.19.0-r0 | — |
| Wolfi rolling | rancher-2.13 +1 | 2.13.5-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/microsoft/kiota-http-go | < 1.5.5 | 1.5.5 | GO-2026-5224 |
| Maven | com.microsoft.kiota:microsoft-kiota-abstractions | < 1.9.1 | 1.9.1 | GHSA-7j59-v9qr-6fq9 |
| npm | kiota-typescript | < 1.0.0-preview.100 | 1.0.0-preview.100 | GHSA-7j59-v9qr-6fq9 |
| NuGet | Microsoft.Kiota.Abstractions | < 1.22.0 | 1.22.0 | GHSA-7j59-v9qr-6fq9 |
| PyPI | microsoft-kiota-http | < 1.9.9 | 1.9.9 | PYSEC-2026-2647 |
Advisories 2
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026