CVE-2026-66822 with a CVSS score of 5.9 is a network-based information disclosure vulnerability in the .NET System.Net.Http component, specifically in SocketsHttpHandler, where a Proxy-Authorization header can be retained across an HTTP redirect and sent to the destination server. This behavior exposes authentication material that should have remained confined to the proxy. The vulnerability affects Microsoft.NETCore.App.Runtime package variants on Windows, Linux, and macOS. The flaw is classified as insertion of sensitive information into sent data. A remote attacker with no privileges and no user interaction can exploit it under high complexity conditions by causing a proxied HTTP request to follow a redirect, allowing basic proxy credentials to be disclosed to the destination server. The business impact is primarily confidentiality loss, because exposed proxy credentials may enable unauthorized access to proxy-controlled resources, compromise internal network trust, increase credential management costs, and create operational, compliance, and reputational risk for organizations relying on affected .NET applications.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-66822 with a CVSS score of 5.9 is a network-based information disclosure vulnerability in the .NET System.Net.Http component, specifically in SocketsHttpHandler, where a Proxy-Authorization header can be retained across an HTTP redirect and sent to the destination server. This behavior exposes authentication material that should have remained confined to the proxy. The vulnerability affects Microsoft.NETCore.App.Runtime package variants on Windows, Linux, and macOS. The flaw is classified as insertion of sensitive information into sent data. A remote attacker with no privileges and no user interaction can exploit it under high complexity conditions by causing a proxied HTTP request to follow a redirect, allowing basic proxy credentials to be disclosed to the destination server. The business impact is primarily confidentiality loss, because exposed proxy credentials may enable unauthorized access to proxy-controlled resources, compromise internal network trust, increase credential management costs, and create operational, compliance, and reputational risk for organizations relying on affected .NET applications.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]