---
id: GHSA-f45q-w629-wr25
title: >-
  Hubuum client library (Rust): Authenticated requests may escape the configured
  base path through redirects
summary: >-
  Hubuum client library (Rust): Authenticated requests may escape the configured
  base path through redirects
severity: medium
cwe:
  - CWE-200
vendor: hubuum_client
product: hubuum_client
ecosystem: rust
affected:
  - 'hubuum_client >= 0.0.1, < 0.6.1'
patched:
  - hubuum_client 0.6.1
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-f45q-w629-wr25'
references:
  - url: >-
      https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-f45q-w629-wr25
  - url: >-
      https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50
  - url: 'https://github.com/advisories/GHSA-f45q-w629-wr25'
tags:
  - ghsa
  - rust
ingestedAt: '2026-07-24T22:40:27.032Z'
---

## Overview

## Impact

The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path prefix.

Exploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.

## Patches

Version 0.6.1 configures both built-in HTTP clients with `reqwest::redirect::Policy::none()`. Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.

## Workarounds

On affected versions, construct a reqwest client with `reqwest::redirect::Policy::none()` and pass it through `with_http_client`. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.

## Affected packages

- `hubuum_client >= 0.0.1, < 0.6.1`

## Remediation

Upgrade to a patched release:

- `hubuum_client 0.6.1`