CVE-2026-121971 (GCVE-0-2026-121971)

Vulnerability from cvelistv5 – Published: 2026-11-04 17:43 – Updated: 2026-11-05 19:07
VLAI
Title
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
Summary
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host. This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients. To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 21:11 UTC
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522 - Insufficiently Protected Credentials
Assigner
Checkmarx CNA under the mitre root
CNA scorecard B 88/100 over 15 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
sensiolabs symfony Affected: 0 , < 5.4.56 (git)
Affected: 6.0.0 , < 6.4.50 (git)
Affected: 7.0.0 , < 7.4.23 (git)
Affected: 8.0.0 , < 8.1.11 (git)
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Nicolas Grekas Thomas Chauchefoin from Trail of Bits
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T21:11:51.149301Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:07:02.219Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/http-client",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\HttpClient\\ScopingHttpClient"
          ],
          "packageName": "symfony/http-client",
          "product": "symfony",
          "repo": "https://github.com/symfony/http-client",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Chauchefoin from Trail of Bits"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe component \u003ccode\u003eScopingHttpClient\u003c/code\u003e\u0026nbsp;in Symfony HttpClient\u0026nbsp;merges the options of its default scope (such as \u003ccode\u003eauth_bearer\u003c/code\u003e or \u003ccode\u003eauth_basic\u003c/code\u003e) into a request before resolving a relative URL against the \u003ccode\u003ebase_uri\u003c/code\u003e, allowing a network-path reference such as \"\u003ccode\u003e//evil.example/steal\"\u003c/code\u003e\u0026nbsp;to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u0026nbsp;\u003cspan\u003eThis affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"\u003ccode\u003ehttps://evil.example/steal\"\u003c/code\u003e receives none. The same happens with a different port or user-info part on the same host.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a b\u003ccode\u003ease_uri\u003c/code\u003e\u0026nbsp;and credentials, including those created with \u003ccode\u003eHttpClient::createForBaseUri()\u003c/code\u003e\u0026nbsp;or configured under \u003ccode\u003eframework.http_client.scoped_clients\u003c/code\u003e.\u003cbr\u003e\u003cbr\u003eTo solve the issue, after\u003cspan\u003e\u0026nbsp;resolving a relative URL against the base URI of the default scope, \u003c/span\u003e\u003ccode\u003eScopingHttpClient\u003c/code\u003e\u003cspan\u003e now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "The component ScopingHttpClient\u00a0in Symfony HttpClient\u00a0merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as \"//evil.example/steal\"\u00a0to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u00a0This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"https://evil.example/steal\" receives none. The same happens with a different port or user-info part on the same host.\n\n\n\n\n\n\n\n\n\nThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri\u00a0and credentials, including those created with HttpClient::createForBaseUri()\u00a0or configured under framework.http_client.scoped_clients.\n\nTo solve the issue, after\u00a0resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T17:43:34.806Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-121971",
    "datePublished": "2026-11-04T17:43:34.806Z",
    "dateReserved": "2026-11-04T13:03:55.851Z",
    "dateUpdated": "2026-11-05T19:07:02.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-121971",
      "date": "2026-11-05",
      "epss": "0.00249",
      "percentile": "0.16311"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://packagist.org/packages/symfony/http-client",
                "defaultStatus": "unaffected",
                "modules": [
                  "Symfony\\Component\\HttpClient\\ScopingHttpClient"
                ],
                "packageName": "symfony/http-client",
                "product": "symfony",
                "repo": "https://github.com/symfony/http-client",
                "vendor": "sensiolabs",
                "versions": [
                  {
                    "lessThan": "5.4.56",
                    "status": "affected",
                    "version": "0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.4.50",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7.4.23",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8.1.11",
                    "status": "affected",
                    "version": "8.0.0",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The component ScopingHttpClient\u00a0in Symfony HttpClient\u00a0merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as \"//evil.example/steal\"\u00a0to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u00a0This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"https://evil.example/steal\" receives none. The same happens with a different port or user-info part on the same host.\n\n\n\n\n\n\n\n\n\nThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri\u00a0and credentials, including those created with HttpClient::createForBaseUri()\u00a0or configured under framework.http_client.scoped_clients.\n\nTo solve the issue, after\u00a0resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent."
          }
        ],
        "id": "CVE-2026-121971",
        "lastModified": "2026-11-05T19:17:16.063",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-121971",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T21:11:51.149301Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-04T18:17:43.077",
        "references": [
          {
            "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
            "url": "https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c"
          },
          {
            "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
            "url": "https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj"
          }
        ],
        "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              },
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-11-05T23:35:02+00:00",
      "cve": "CVE-2026-121971",
      "id": "CVE-2026-121971",
      "initial_release_date": "2026-11-04T17:43:34.806000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "symfony/http-client: symfony/http-client: Information disclosure via relative URL handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-121971.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.