CVE-2026-49336
MediumPublic exploit@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients.
Published Jun 19, 2026 · Updated Sep 10, 2026 · Also known as EUVD-2026-38061, GHSA-396q-4vc8-28x9
Key Facts
Routine patching- CVE-2026-49336 is a medium-severity vulnerability (CVSS 5.5 v4) affecting keycloak-26.6 (chainguard), @microsoft/kiota-http-fetchlibrary (npm), kiota-typescript.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 1.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including @microsoft/kiota-http-fetchlibrary 1.0.0-preview.102, keycloak-26.6 26.6.4-r15, kiota-typescript 1.0.0-preview.102.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
5.5
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS (30-day exploit likelihood)
1.2%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-49336 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, @microsoft/kiota-http-fetchlibrary's RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, but the default scrubSensitiveHeaders callback in RedirectHandlerOptions uses case-sensitive property deletion (delete headers.Authorization, delete headers.Cookie) on a headers object that FetchRequestAdapter.getRequestFromRequestInformation has already lower-cased. The delete therefore targets keys that do not exist, the scrub is a no-op, and any Bearer token or Cookie attached by a kiota-generated SDK is forwarded to an attacker-controlled host across a 30x redirect. This is reachable in the default middleware chain (MiddlewareFactory.getDefaultMiddlewares) with no custom configuration, and applies to every kiota-generated TypeScript SDK that uses BaseBearerTokenAuthenticationProvider or any other authentication provider that sets the Authorization request header. Version 1.0.0-preview.102 patches the issue.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak-26.6chainguard | See advisory | 26.6.4-r15 |
| @microsoft/kiota-http-fetchlibrarynpm | >= 1.0.0-preview.97 | 1.0.0-preview.102 |
| kiota-typescript | >= 1.0.0-preview.97, | 1.0.0-preview.102 |
Patched Releases
@microsoft/kiota-http-fetchlibrary
1.0.0-preview.102
keycloak-26.6
26.6.4-r15
kiota-typescript
1.0.0-preview.102
Timeline
Publicly disclosed
Jun 19, 2026
Last updated
Sep 10, 2026
Weakness Type
- CWE-178 Improper Handling of Case Sensitivity
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49336.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-49336
- otherhttps://github.com/microsoft/kiota-typescript
- otherhttps://github.com/microsoft/kiota-typescript/commit/09f8bd9b34d68bf412a9b78f6ca7e7961ef14974
FAQ
Common Questions.
@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients.
Affected: keycloak-26.6 (chainguard); @microsoft/kiota-http-fetchlibrary (npm) versions >= 1.0.0-preview.97; kiota-typescript versions >= 1.0.0-preview.97,. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including @microsoft/kiota-http-fetchlibrary 1.0.0-preview.102, keycloak-26.6 26.6.4-r15, kiota-typescript 1.0.0-preview.102.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-49336 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo