Is CVE-2026-49336 in the CISA KEV catalog?

No. CVE-2026-49336 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2026-49336?

CVE-2026-49336 has a CVSS v4 base score of 5.5 (MEDIUM).

What is the EPSS score for CVE-2026-49336?

CVE-2026-49336 has an EPSS score of 0.65% (47th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix or mitigate CVE-2026-49336?

No published fix for CVE-2026-49336 has been found yet. Check the linked vendor advisories for guidance as it becomes available.

CVE & CISA-KEV Catalog

CVE-2026-49336

MEDIUM

5.5

CVSS v4

NVD

Description

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Cookie` from cross-origin redirect targets, but the default `scrubSensitiveHeaders` callback in `RedirectHandlerOptions` uses case-sensitive property deletion (`delete headers.Authorization`, `delete headers.Cookie`) on a headers object that `FetchRequestAdapter.getRequestFromRequestInformation` has already lower-cased. The delete therefore targets keys that do not exist, the scrub is a no-op, and any Bearer token or Cookie attached by a kiota-generated SDK is forwarded to an attacker-controlled host across a 30x redirect. This is reachable in the default middleware chain (`MiddlewareFactory.getDefaultMiddlewares`) with no custom configuration, and applies to every kiota-generated TypeScript SDK that uses `BaseBearerTokenAuthenticationProvider` or any other authentication provider that sets the `Authorization` request header. Version 1.0.0-preview.102 patches the issue.

CWE-178 CWE-200Information Exposure

How to fix

No published remediation has been found for this vulnerability's affected products yet.

Mitigation guidance may be in the linked vendor advisories in the References section below.

CVSS v4 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

Impact

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit Intelligence

0.65%probability of exploitation in 30 days

47thpercentile

Moderate risk: more likely to be exploited than 47% of all known CVEs.

References

Other references2

Embed a live status badge for CVE-2026-49336

Markdown

[![CVE-2026-49336](https://tridentstack.com/cve/badge/CVE-2026-49336.svg)](https://tridentstack.com/cve/CVE-2026-49336)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-49336"><img src="https://tridentstack.com/cve/badge/CVE-2026-49336.svg" alt="CVE-2026-49336"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-06-23.