Information disclosure in follow-redirects - CVE-2026-40895

Vulnerability identifier: #VU125981

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40895

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the redirect handling logic in index.js when following cross-domain redirects. A remote attacker can cause a request to be redirected to an attacker-controlled domain to disclose sensitive information.

Custom authentication headers such as API keys or auth tokens may be forwarded to the redirect target, while only authorization, proxy-authorization, and cookie headers are stripped.

follow-redirects
IBM Fusion HCI
IBM MQ Operator
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM supplied MQ Advanced container images
IBM MQ Appliance
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Maximo Scheduler Optimizer
IBM Security SOAR
Red Hat OpenShift Container Platform

Install security update from vendor's website.

follow-redirects - update to 1.16.0
IBM Fusion HCI - update to 2.13.0
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM MQ Appliance - addressed in versions 9.4.0.25, 9.4.5.2
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.25, 16.1.3.6
IBM Security SOAR - update to 51.0.10.1
Red Hat OpenShift Container Platform - addressed in versions 4.19.35, 4.19.40, 4.22.6
Maximo Scheduler Optimizer - addressed in versions 9.0.25, 9.1.14, 9.2.1

• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
• https://github.com/advisories/GHSA-r4q5-vmmm-2653

• Information disclosure in follow-redirects
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for follow-redirects
• IBM MQ Appliance update for follow-redirects
• IBM Security SOAR update for follow-redirects
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• IBM Maximo Scheduler Optimizer update for follow-redirects
• IBM Fusion and IBM Fusion HCI update for follow-redirects
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19