Medium · CVSS 6.3CVE-2026-89186

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186

Answer in brief

CVE-2026-89186 records a Medium severity (CVSS 6.3) vulnerability in mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches. The current sources do not mark it as known exploited. The current feed maps ZenHive/mpp (generic), ZenHive/mpp (generic), ZenHive/zenhive/mpp (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 16, 2026Updated Sep 16, 2026Source checked Oct 31, 2026First seen by HOL Sep 16, 2026Material review Sep 16, 2026

Upstream Advisory

Affected scope and exposure questions

The current feed maps ZenHive/mpp (generic), ZenHive/mpp (generic), ZenHive/zenhive/mpp (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ZenHive/mppgeneric	>=2d4d1d94aae7790ae0623063961adbeef171fa71 <2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b	2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b
ZenHive/mppgeneric	>=0.1.0 <0.16.2	0.16.2
ZenHive/zenhive/mppgeneric	>=2d4d1d94aae7790ae0623063961adbeef171fa71 <2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b	2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b

Recommended response

Check inventory. Check lockfiles and deployed manifests for ZenHive/mpp, ZenHive/mpp, ZenHive/zenhive/mpp.

Review the reported fix. Source-reported workaround: In the application mounted behind MPP.Plug, stop setting Cache-Control on paid routes so the library's private survives to the response, or set a directive that is itself safe for a shared cache (private, or no-store). Where the application must set its own caching policy, configure the CDN or reverse proxy not to cache responses carrying a Payment-Receipt header.

Sources and claim methodology

Upstream source description

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource. This issue affects mpp: from 0.1.0 before 0.16.2.

Quoted source text, attributed separately from HOL analysis.

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared cachesCVE-2026-89186

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs