Information disclosure in scrapy - #VU127076
Published: July 25, 2022 / Updated: April 23, 2026
Vulnerability identifier: #VU127076
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose proxy credentials to a different proxy.
The vulnerability exists due to improper handling of authentication headers in the built-in HTTP proxy downloader middleware when processing requests whose proxy metadata is changed during retries or redirects. A remote attacker can use a proxy-rotation setup that changes proxy metadata without clearing the previous authentication header to disclose proxy credentials to a different proxy.
The issue affects environments that rotate proxies from different proxy providers and where at least one proxy requires credentials.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - addressed in versions 1.8.3, 2.6.2