Detections
Analytics

Echo: python-webob: security update to 1:1.8.10-0+deb13u1+e1webob: security update to 1.8.11

medium Tenable Cloud Security Plugin ID 458745

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - WebOb provides objects for HTTP requests and responses. Prior to 1.8.11,
 Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or
 leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An
 attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore
 bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect.
 Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because
 they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated
 attacker who can influence an application's redirect target can send users to an attacker-controlled host
 for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This
 issue is fixed in version 1.8.11. (CVE-2026-54770)

Solution

Update the webob library and its related packages to version 1.8.11 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-54770

Plugin Details

Severity: Medium

ID: 458745

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.98

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-54770

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/21/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-54770