How Information Disclosure via Unstripped Credential Headers During HTTP Redirects Happens in Electron and How to Fix It

How Information Disclosure via Unstripped Credential Headers During HTTP Redirects Happens in Electron and How to Fix It

The Vulnerability at a Glance

Summary

CVE-2026-54673 is a high-severity information disclosure vulnerability in electron-updater (via builder-util-runtime) where credential headers are not stripped before following HTTP redirects, potentially exposing authentication tokens to unintended servers. The vulnerability was present in builder-util-runtime@9.5.1 and was resolved by upgrading to 9.7.0. This fix is critical for any Electron application that uses auto-update functionality against endpoints that may issue redirects.

Direct Answer: CVE-2026-54673 is a high-severity information disclosure vulnerability (CWE-200) in the electron-updater component of electron-builder, specifically in the builder-util-runtime package. When the updater follows HTTP redirects, it fails to strip Authorization and other credential headers from the redirected request, potentially sending credentials to an attacker-controlled server. The fix is to upgrade builder-util-runtime from version 9.5.1 to 9.7.0, which adds proper header-stripping logic before following cross-origin redirects.

Introduction

Every time a user launches an Electron application that uses electron-updater, a background HTTP request goes out to check for a new version. If that update server responds with a redirect — a perfectly normal and common pattern in CDN-backed infrastructure — what happens to the Authorization header that was on the original request?

In builder-util-runtime@9.5.1, the answer was: it follows along for the ride, regardless of where the redirect points. This is the core of CVE-2026-54673. The vulnerable package, pinned at 9.5.1 in pnpm-lock.yaml, was used by electron-updater to perform authenticated update checks. When the update endpoint issued an HTTP 3xx redirect to a different origin, the runtime blindly forwarded all headers — including Authorization — to the new destination.

For developers building Electron apps with private update channels (common in enterprise software), this meant that credentials configured for your update server could silently leak to a CDN edge node, a misconfigured load balancer, or, in an active attack scenario, an adversary-controlled server.

The Vulnerability Explained

What builder-util-runtime Does

builder-util-runtime is a low-level utility package that underpins electron-builder and electron-updater. Among other things, it handles the HTTP machinery for downloading update manifests and binary artifacts. This includes constructing requests, managing headers, and following redirects.

The Vulnerable Pattern

The problem is a well-known HTTP client pitfall: when following a redirect, the client must decide whether to preserve the original request headers. The safe behavior — mandated by RFC 9110 §15.4 and implemented by browsers — is to strip sensitive headers like Authorization when the redirect crosses an origin boundary.

In builder-util-runtime@9.5.1, this stripping did not happen. The pnpm-lock.yaml before the fix recorded:

# pnpm-lock.yaml (BEFORE)
builder-util-runtime@9.5.1:
  resolution: {integrity: sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==}
  engines: {node: '>=12.0.0'}

And the snapshot that wires electron-updater to this package:

# pnpm-lock.yaml snapshot (BEFORE)
electron-updater:
  dependencies:
    builder-util-runtime: 9.5.1   # <-- vulnerable version

A Concrete Attack Scenario

Imagine an Electron application configured to check for updates at https://updates.internal.corp/latest.yml with an Authorization: Bearer <token> header. The internal update server is behind a load balancer that, under certain conditions (e.g., a misconfiguration or a deliberate DNS rebinding attack), redirects to https://attacker.example.com/latest.yml.

With builder-util-runtime@9.5.1:

1. electron-updater sends GET https://updates.internal.corp/latest.yml with Authorization: Bearer <token>.
2. The server responds with 302 Found → Location: https://attacker.example.com/latest.yml.
3. builder-util-runtime follows the redirect and sends GET https://attacker.example.com/latest.yml — still carrying Authorization: Bearer <token>.
4. The attacker's server logs the token. The application user has no idea.

The token can now be used to authenticate against the original update server, download private release artifacts, or pivot further into internal infrastructure.

Real-World Impact

This is not a theoretical concern. Electron apps are commonly distributed to enterprise environments where:

• Update servers sit behind CDNs or reverse proxies that issue redirects.
• Authorization headers carry long-lived API tokens or OAuth bearer tokens.
• Compromising the update token can grant access to private release pipelines or internal artifact stores.

The severity is rated HIGH precisely because the credential exposure is silent, automatic, and requires no user interaction beyond the app simply being open.

The Fix

What Changed

The fix has two parts, both visible in the PR diff.

1. package.json — Adding a pnpm override

// package.json (BEFORE)
"pnpm": {
  "overrides": {
    "minimatch@3>brace-expansion": "1.1.18",
    "minimatch@5>brace-expansion": "2.1.4",
    "minimatch@9>brace-expansion": "2.1.4",
    "minimatch@10>brace-expansion": "5.0.9"
  }
}

// package.json (AFTER)
"pnpm": {
  "overrides": {
    "minimatch@3>brace-expansion": "1.1.18",
    "minimatch@5>brace-expansion": "2.1.4",
    "minimatch@9>brace-expansion": "2.1.4",
    "minimatch@10>brace-expansion": "5.0.9",
    "builder-util-runtime": "9.7.0"   // <-- new override
  }
}

This override forces every package in the dependency tree that depends on builder-util-runtime to resolve to 9.7.0, regardless of what version they declare in their own package.json. Without this, a transitive dependency could silently pull in the vulnerable 9.5.1 again.

2. pnpm-lock.yaml — Updating the resolved version and integrity hash

# pnpm-lock.yaml (BEFORE)
builder-util-runtime@9.5.1:
  resolution: {integrity: sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==}

# pnpm-lock.yaml (AFTER)
builder-util-runtime@9.7.0:
  resolution: {integrity: sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==}

The integrity hash change is critical — it ensures the installed package is cryptographically verified against the new, patched release. An attacker cannot substitute the old vulnerable package without the hash check failing.

The snapshot section also reflects the update:

# Snapshot (BEFORE)
electron-updater:
  dependencies:
    builder-util-runtime: 9.5.1

# Snapshot (AFTER)
electron-updater:
  dependencies:
    builder-util-runtime: 9.7.0

Why 9.7.0 Fixes It

builder-util-runtime@9.7.0 introduces header-stripping logic in its redirect-following code. When the HTTP client receives a 3xx response and the Location header points to a different origin (different scheme, host, or port), sensitive headers — including Authorization — are removed from the forwarded request. This matches the behavior of modern browsers and complies with RFC 9110.

The fix is backward compatible: requests to the same origin preserve all headers as before. Only cross-origin redirects are affected, and for those, stripping credentials is the correct and secure behavior.

Key Takeaways

• builder-util-runtime@9.5.1 leaks Authorization headers on cross-origin HTTP redirects — any Electron app using electron-updater with authenticated update endpoints was at risk.
• A pnpm override in package.json is required to guarantee the patched version is used across all transitive dependents, not just the direct electron-updater dependency.
• The integrity hash in pnpm-lock.yaml changed from sha512-qt41t... to sha512-g/kR5... — always verify lockfile hash changes when applying security patches to confirm you're getting the right artifact.
• Redirect-following HTTP clients in Node.js do not strip headers by default in many popular libraries — this is a class of vulnerability worth auditing explicitly in any authenticated update or API client code.
• The attack requires no user interaction — the credential leak happens silently in the background during a routine update check, making it especially dangerous in enterprise deployments.

How Orbis AppSec Detected This

• Source: The builder-util-runtime HTTP client in electron-updater receives a server-issued Location header (HTTP 3xx redirect response) pointing to an external origin.
• Sink: The redirect-following logic in builder-util-runtime@9.5.1 forwards the full original request headers — including Authorization — to the URL specified in the Location header without origin validation.
• Missing control: No cross-origin check was performed before re-attaching credential headers to the redirected request. The library lacked the RFC 9110-compliant header-stripping step.
• CWE: CWE-200 – Exposure of Sensitive Information to an Unauthorized Actor (also related: CWE-522 – Insufficiently Protected Credentials)
• Fix: builder-util-runtime was upgraded from 9.5.1 to 9.7.0 via a pnpm override, enforcing the patched version across the entire dependency tree and updating the lockfile integrity hash.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-54673 is a reminder that security vulnerabilities in auto-update infrastructure can be particularly damaging: the very mechanism designed to deliver security patches can become a channel for credential theft. The root cause — a missing cross-origin header-stripping step in builder-util-runtime@9.5.1 — is subtle, easy to miss in code review, and yet has serious real-world consequences for any Electron application using authenticated update endpoints.

The fix is straightforward: upgrade to builder-util-runtime@9.7.0 and enforce it with a package manager override to prevent transitive dependency drift. More broadly, treat your update client's HTTP behavior with the same scrutiny you'd apply to any code handling authentication credentials — because that's exactly what it is.