CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.

• CWE-918

• https://github.com/advisories/GHSA-33mh-2634-fwr2Vendor Advisory
• https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484Exploit, Vendor Advisory
• https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484Exploit, Vendor Advisory

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33631ClearanceKit intercepts file-system access events on macOS a…8.7
• CVE-2026-33632ClearanceKit intercepts file-system access events on macOS a…7.8
• CVE-2026-33633Kitty is a cross-platform GPU based terminal. Versions 0.46.…8.8
• CVE-2026-33634Trivy is a security scanner. On March 19, 2026, a threat act…8.8
• CVE-2026-33635iCalendar is a Ruby library for dealing with iCalendar files…4.3
• CVE-2026-33636LIBPNG is a reference library for use in applications that r…7.6
• CVE-2026-33638Ech0 is an open-source, self-hosted publishing platform for …5.3
• CVE-2026-33640Outline is a service that allows for collaborative documenta…9.8
• CVE-2026-33641Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-33642Kitty is a cross-platform GPU based terminal. In versions 0.…9.8
• CVE-2026-33643SQL Injection vulnerability in SchemaHero 0.23.0 via the col…7.4
• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3