ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-59180

Apprise forwards configured auth headers across cross-origin HTTP redirects

Published Oct 14, 2026 · catalog updated Oct 14, 2026 · Apprise forwards configured auth

Check if you run it

No confirmed exploitation is on record for CVE-2026-59180. EPSS is 0.32%. Act only if a listed version of Apprise forwards configured auth is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Apprise forwards configured auth).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.32%
Remediation
Version ranges on file
Affected products
PyPI apprise · pip apprise · pypi apprise

# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, that destination can return a to an arbitrary host and Apprise forwards the user's secret ( , , bearer tokens in query, custom values) to that cross-origin host. The attacker does **not** need to control the original Apprise URL — only the response from a destination the operator already trusts. This is the application-layer analogue of urllib3 [ ](https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf) / (" forwarded across cross-origin redirect"). # Affected versions All releases up to and including (latest PyPI release as of filing, 2026-04-26). Fixed in v1.11.0 (released 2026-05-29), which includes [PR #1610](https://github.com/caronc/apprise/pull/1610) (merged 2026-05-16, commit 68c0aef218055e4586cf4605fd6b56358f5f462d). # Details (pre-fix HEAD, lines 226-244, verbatim): follows 3xx redirects by default and re-attaches the dict on the redirected request, regardless of origin. The same shape exists across ~50 plugins ( , , , , , , , and most other HTTP-based plugins), plus in and . ## Reproduction (local, safe) Observed on HEAD (2026-05-13): prints -- the user-supplied token followed the cross-origin redirect. # Patch Fix landed in [ ](https://github.com/caronc/apprise/pull/1610) (merged 2026-05-16, commit ): - Adds URL parameter on every plugin URL - Adds global default - Equivalent flags wired into and The default remains for backwards compatibility -- operators who relay notifications through destinations they don't fully trust should append to their Apprise URLs or set globally. Released in v1.11.0 (2026-05-29, available on PyPI). Related: - Docum

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI apprise0 → 1.11.0
  • pip apprise<= 1.10.0
  • pypi appriseversion unspecified

How to fix CVE-2026-59180

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-59180. EPSS is 0.32%. Act only if a listed version of Apprise forwards configured auth is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.11.0, <= 1.10.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-601: URL Redirection to Untrusted Site (Open Redirect). EPSS 0.32%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · GitHub Advisory Database

    Detected

    # Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, t

  2. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    apprise fixed in 1.11.0

  3. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    apprise fixed in 1.11.0

  4. Oct 14, 2026 · GitHub Advisory Database

    Updated

    # Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders ( , ) follow HTTP 3xx redirects by default and **re-send the user-configured auth headers and query parameters on the redirected request**. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position on an unprotected network path, t

Sources

  • CVE.orgVulnerability recordCVE-2026-59180

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-59180

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-856c-92hv-3vxx

    Apprise forwards configured auth headers across cross-origin HTTP redirects

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-59180

    Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (apprise/attachment/http.py, apprise/config/http.py) follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured destination is later compromised (service takeover, malicious update), or an attacker holds a MITM position

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-856c-92hv-3vxx

    Apprise forwards configured auth headers across cross-origin HTTP redirects

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.