fix: credentials leaking to cross-origin redirect targets

[AlbinaBlazhko17]

What/Why/How?

User can configure in redocly.yaml resolve.http.headers property with the custom header, which contains credentials. The hacker can find the endpoint, which accepts redirects and pass to it redirect URL to the malware website. Fetch automatically redirects to the malware website and strips only Authorization, Cookie, Host, and Proxy Authorization header, so a custom token header such as X-Api-Key is re-sent to the redirect target. I implemented manual redirecting to check on every step if the url matches.

Reference

Testing

Screenshots (optional)

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Security fix in HTTP ref resolution affects all URL fetches during bundle/resolve; behavior change for redirect chains but intended and covered by new tests.

Overview
Fixes a credential leak when resolving external OpenAPI refs over HTTP: custom headers from resolve.http.headers (e.g. X-Api-Key) could be sent to an attacker-controlled host if the initial URL returned a redirect, because fetch only strips a few standard auth headers on redirect—not user-defined ones.

readFileFromUrl now uses redirect: 'manual' and follows redirects itself (up to 20 hops). On each hop it rebuilds headers with getMatchingHeaders for the current URL, so secrets are only attached when the request URL still matches the configured matches glob—cross-origin redirect targets get no configured credentials; same-host redirects that still match keep them.

Adds focused security tests in resolve-http.test.ts and updates bundle/http resolve expectations to include redirect: 'manual'. Patch changeset for @redocly/openapi-core.

^{Reviewed by Cursor Bugbot for commit 65f8fc6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 65f8fc6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Patch
@redocly/cli	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	81.39% (🎯 81%)	7414 / 9109
🔵	Statements	80.75% (🎯 80%)	7708 / 9545
🔵	Functions	84.58% (🎯 84%)	1476 / 1745
🔵	Branches	73.09% (🎯 73%)	5011 / 6855

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/core/src/utils/read-file-from-url.ts	87.5%	68.75%	100%	86.95%	21, 28-30, 35

Generated in workflow #10370 for commit 65f8fc6 by the Vitest Coverage Report Action

[github-actions]

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-latest	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)
cli-next	▓ 1.01x ± 0.01	▓ 1.00x ± 0.01	▓ 1.00x ± 0.01

[thegr1ffyn]

Hi @AlbinaBlazhko17 @JLekawa , I am the reporter of this vulnerability, kindly add me as the reporter in the changelog.

[RomanHotsiy]

Sorry, @thegr1ffyn, but we do not add links to reporter to our changelog (you can check our changelog and see we never did it).
I am happy to mention you at x.com though.

[thegr1ffyn]

Hi @DmitryAnansky @kanoru3101 @tatomyr @JLekawa, following up on CVE assignment for the reported vulnerabilities.

Both fixes are merged and released (#2881 in v2.33.0, #2891 as well). @DmitryAnansky confirmed here that a CVE would be created and an update posted once published, and @kanoru3101 offered to file a GitHub Advisory on #2891. I'd like to help close this out.

If you can publish the GHSAs via Security → Advisories → New draft advisory (and request a CVE after publish) and add me (@thegr1ffyn) in Credits, The PoC and advisory content is already shared via email. If it's easier for me to request the CVEs through MITRE's process instead, just say the word and I'll proceed that way so these get identifiers either way. Thanks!