CVE-2026-54171

Name of the Vulnerable Software and Affected Versions Excon versions prior to 1.5.0

Description The RedirectFollower middleware fails to strip sensitive headers when following redirects and lacks a mechanism to define a custom list of headers to be removed. This behavior can lead to the inadvertent leakage of sensitive data if the initial request contains header information not intended for the redirect target.

Recommendations Update to version 1.5.0. As a temporary workaround, backport the fix to a custom redirect follower middleware.