# Bearer token leaked across redirects

HTTP clients that follow redirects while keeping Authorization or bearer tokens, and user-controlled endpoints paired with system credentials

_Area: Cloud and container security. Seen in 3 disclosed reports; one confirmed bounty: $1,000; latest 2026-04-21. Updated 2026-10-25._

## How it works
An HTTP client trusts the endpoint it was configured to talk to, so when that endpoint answers with a redirect (30X), the client follows it and keeps the `Authorization` header attached. The assumption that breaks is that the redirect target is as trustworthy as the original host. In a cluster, the original host is a system component (aggregated API server, kubelet) whose identity the client was told to trust; a hijacked or fake component can point the client anywhere and the client hands over its bearer token [E1](https://bugbountylibrary.com/r/h1%3A1544133.md)[E3](https://bugbountylibrary.com/r/h1%3A863979.md). A related shape: a component merges user-supplied parameters with system-configured credentials, so a user-chosen endpoint receives the system secret [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).

## Where it shows up
- Client code (kubectl, control-plane clients, SDKs) that follows redirects without stripping `Authorization` [E1](https://bugbountylibrary.com/r/h1%3A1544133.md)[E3](https://bugbountylibrary.com/r/h1%3A863979.md)
- Aggregated API servers or kubelets reachable via label-selector service routing, so a workload can stand in for a system component [E1](https://bugbountylibrary.com/r/h1%3A1544133.md)
- Resolvers/clients where an endpoint field (`serverURL`, registry, host) comes from user params and a credential param may be omitted [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)
- Credential fallback logic: "if user gave no token, use the system secret" [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)
- Any component that returns 30X on an authenticated API path

## How to review
Check the invariant: a bearer token must only be sent to the exact host it was issued for. Concretely: does the HTTP client disable redirect-following, or strip `Authorization` on cross-host redirects? Is the redirect target compared against the configured endpoint? For credential merging, is the user-supplied endpoint required to equal the system-configured one before the system token is attached, and is the fallback to a system secret gated on that match [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)? Also check whether a workload can be scheduled to receive traffic meant for a system component via label selectors [E1](https://bugbountylibrary.com/r/h1%3A1544133.md).

## Variants seen
- Hijacked aggregated API server (metrics-server) redirecting control-plane clients, leaking tokens [E1](https://bugbountylibrary.com/r/h1%3A1544133.md)
- Fake kubelet returning 301 so kubectl forwards its token and exec requests to other nodes [E3](https://bugbountylibrary.com/r/h1%3A863979.md)
- Resolver sending system Git token to user-controlled `serverURL` when token param omitted [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)

## Impact and severity
Token theft enables impersonation of the client's identity: control-plane credentials [E1](https://bugbountylibrary.com/r/h1%3A1544133.md), cross-node authenticated exec [E3](https://bugbountylibrary.com/r/h1%3A863979.md), or a shared system PAT exfiltrated by a tenant [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md). Severity is high because the leaked credential carries the victim's privileges; it worsens when the token is long-lived or shared across tenants [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md) and when the client is a privileged control-plane component [E1](https://bugbountylibrary.com/r/h1%3A1544133.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1544133.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md
- E3: https://bugbountylibrary.com/r/h1%3A863979.md