CVE-2026-59180 Details
Description
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.
A vulnerability in the Apprise notification library, prior to version 1.11.0, allows for the unintentional forwarding of sensitive user-authenticated headers across cross-origin HTTP redirects. This issue arises in HTTP-based notification plugins, as well as in HTTP attachment and configuration loaders. The vulnerability can be exploited if a trusted destination is compromised or if an attacker intercepts the network traffic, enabling the capture of secrets such as Authorization headers, bearer tokens, custom headers, and service keys.
Users can upgrade to Apprise version 1.11.0 or later, and should also set the 'http_redirects' option to False if they are using destinations that are not fully trusted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caronc/apprise/security/advisories/GHSA-856c-92hv-3vxx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/caronc/apprise/commit/68c0aef218055e4586cf4605fd6b56358f5f462d | [email protected] | Source CodeVendor |
| https://github.com/caronc/apprise/pull/1610 | [email protected] | Issue TrackingVendor |
| https://github.com/caronc/apprise/releases/tag/v1.11.0 | [email protected] | Release NotesVendor |
| https://github.com/caronc/apprise/security/advisories/GHSA-856c-92hv-3vxx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apprise | <= 1.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | New CVE Received | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |