high severity · published 2026-11-06
When an originless Agent combines the redirect and shared cache interceptors, a redirect that bounces through an untrusted origin and back is still cached under the trusted origin's key, and an intermediate hop's Vary header is dropped. An attacker can poison the cache so a response that varies on Authorization or Cookie is served to other users of the same client.
Fixed in: 8.12.4
CVE: CVE-2026-116592
Source: NVD
You are affected if the installed version is older than 8.12.4. Check the version you have and update to 8.12.4 or later. The fixed version is verified against a vendor or advisory source.
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 818 and your operating system.