Use of cache containing sensitive information in Angular - CVE-2026-50170
Published: August 20, 2026
Vulnerability identifier: #VU144424
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-50170
CWE-ID: CWE-524
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of cache containing sensitive information in HttpTransferCache when processing delegated HTTP requests with withRequestsMadeViaParent() before parent interceptors attach authentication credentials. A remote attacker can request a cached SSR-rendered page containing another user\'s authenticated response data to disclose sensitive information.
Exploitation requires SSR and hydration to be enabled, a hierarchical HttpClient configuration using withRequestsMadeViaParent(), parent-level injection of authentication credentials, and shared caching of SSR HTML responses across user sessions.
Affected software
Angular
How to mitigate CVE-2026-50170
Install security update from vendor's website.
Angular - addressed in versions 20.3.28, 21.2.20, 22.1.1