CVE-2026-48595

Name of the Vulnerable Software and Affected Versions tesla versions 1.4.0 through 1.18.2

Description Improper handling of case sensitivity in Tesla.Middleware.FollowRedirects allows credential leakage to third-party origins during cross-origin redirects. The middleware attempts to strip security-sensitive headers by comparing them against a lowercase filter list containing authorization and host. However, because Tesla preserves header keys exactly as provided by the caller without normalization, headers using canonical casing, such as Authorization, do not match the lowercase filter and are forwarded to the redirect destination. An attacker who can control the Location: response—via their own endpoint, a redirect-open upstream, or a compromised origin—can capture bearer tokens or other authorization materials. This occurs when the application uses Tesla.Middleware.FollowRedirects and sets headers with non-lowercase keys.

Recommendations Update tesla to version 1.18.3. As a temporary workaround, normalize all header keys to lowercase before passing them to Tesla, specifically using authorization instead of Authorization when setting headers via Tesla.put header/3 or Tesla.Middleware.Headers.