Scrapy authorization header leakage on cross-domain redirect
Impact
When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.
The right behavior would be to drop the Authorization header instead, in this scenario.
Patches
Upgrade to Scrapy 2.11.1.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.
Workarounds
If you cannot upgrade, make sure that you are not using the Authentication header, either directly or through some third-party plugin.
If you need to use that header in some requests, add "dont_redirect": True to the request.meta dictionary of those requests to disable following redirects for them.
If you need to keep (same domain) redirect support on those requests, make sure you trust the target website not to redirect your requests to a different domain.
Acknowledgements
This security issue was reported by @ranjit-git through huntr.com.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | scrapy | >= 2, < 2.11.1, < 1.8.4 | 2.11.1, 1.8.4 |
References
- https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
- https://nvd.nist.gov/vuln/detail/CVE-2024-3574
- https://github.com/scrapy/scrapy/commit/ee7bd9d217fc126063575d5649f00bdeeca2faae
- https://github.com/scrapy/scrapy
- https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9
- https://pypi.org/project/scrapy
- https://github.com/advisories/GHSA-cw9j-q3vf-hrrv
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- Python (PyPI)
- Package
scrapy- Disclosed
- 15.02.2024
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1908 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-cw9j-q3vf-hrrv - CC BY 4.0
Vulnerability history: scrapy
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 09.2017 09.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 6
- Medium 8
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 1
- 2022: 3
- 2023: 0
- 2024: 6
- 2025: 1
- 2026: 2
-
Scrapy authorization header leakage on cross-domain redirect this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.