Attack Chain

1. An attacker establishes control over a web server or service capable of issuing HTTP 302 redirects to an arbitrary, attacker-controlled domain (e.g., a malicious server, a redirect-open service, or a compromised upstream server).
2. A victim application, using the tesla Elixir HTTP client library (version 0.6.0 through 1.18.2) with Tesla.Middleware.FollowRedirects enabled, constructs an outbound HTTP request.
3. The victim application includes an Authorization header with canonical casing (e.g., {"Authorization", "Bearer <token>"}) for authentication in its request.
4. The victim application sends its request to an endpoint, which the attacker can influence to issue an HTTP 302 (or similar redirect status code) pointing to the attacker-controlled domain.
5. The Tesla.Middleware.FollowRedirects component within the victim application attempts to filter sensitive headers before automatically following the redirect.
6. Due to a case-sensitive comparison logic ("authorization" vs. "Authorization"), the middleware fails to identify and strip the canonical Authorization header from the outgoing request.
7. The tesla client follows the redirect and inadvertently includes the sensitive Authorization header, complete with its bearer token or other credentials, in the request to the attacker-controlled domain, leading to credential theft.

Impact

The vulnerability carries a high severity (CVSS v4.0: 8.2). Any application utilizing tesla versions 0.6.0 through 1.18.2 with Tesla.Middleware.FollowRedirects and supplying non-lowercase Authorization headers is at risk. Successful exploitation results in the leakage of sensitive credentials, such as bearer tokens, to an attacker-controlled endpoint. This can lead to unauthorized access to systems or data, session hijacking, and further compromise of the victim's environment, directly impacting the confidentiality and integrity of affected applications and their users.

Recommendation

• Prioritize upgrading the tesla Elixir HTTP client library to version 1.18.3 or later immediately to remediate CVE-2026-48595.
• If immediate patching is not possible, implement the recommended workaround by normalizing all Authorization header keys to lowercase (e.g., "authorization") before passing them to tesla via Tesla.put_header/3 or Tesla.Middleware.Headers.
• Review application code for the usage of Tesla.Middleware.FollowRedirects and how Authorization headers are set to identify potentially vulnerable instances.