Answer in brief
CVE-2026-59180 records a Low severity (CVSS 3.1) vulnerability in Apprise forwards configured auth headers across cross-origin HTTP redirects. The current sources do not mark it as known exploited. The current feed maps caronc/apprise (generic), apprise (pip), apprise (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps caronc/apprise (generic), apprise (pip), apprise (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| caronc/apprisegeneric | <1.11.0 | 1.11.0 |
| apprisepip | <=1.10.0 | 1.11.0 |
| apprisepypi | >=0 <1.11.0 | 1.11.0 |
Published upstream
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.
Quoted source text, attributed separately from HOL analysis.