Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91766
Scope
What the vendor says is affected
- cbl2 binutils 2.37-19 on CBL Mariner 2.0
- cbl2 grpc 1.42.0-11 on CBL Mariner 2.0
- azl3 nmap 7.95-2 on Azure Linux 3.0
- cbl2 nmap 7.93-3 on CBL Mariner 2.0
- cbl2 rubygem-mini_portile2 2.8.0-1 on CBL Mariner 2.0
- cbl2 rust 1.72.0-11 on CBL Mariner 2.0
- cbl2 tensorflow 2.11.1-2 on CBL Mariner 2.0
- cbl2 boost 1.76.0-4 on CBL Mariner 2.0
- cbl2 ceph 16.2.10-11 on CBL Mariner 2.0
- cbl2 cloud-hypervisor 32.0-7 on CBL Mariner 2.0
- cbl2 crash 8.0.1-5 on CBL Mariner 2.0
- cbl2 gcc 11.2.0-9 on CBL Mariner 2.0
- cbl2 gdb 11.2-10 on CBL Mariner 2.0
- cbl2 keras 2.11.0-3 on CBL Mariner 2.0
- cbl2 python-tensorboard 2.11.0-3 on CBL Mariner 2.0
- azl3 rust 1.75.0-22 on Azure Linux 3.0
- azl3 rust 1.86.0-10 on Azure Linux 3.0
- azl3 tensorflow 2.16.1-9 on Azure Linux 3.0
- cbl2 tcl 8.6.13-3 on CBL Mariner 2.0
- cbl2 zlib 1.2.13-2 on CBL Mariner 2.0
Timeline
When this advisory changed
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Updated by Microsoft Security Response Center
The vendor changed the advisory after it was first published.
- Added to SecurityAlert
We collected the advisory from the official source.
Vulnerabilities