{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89186", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-09-11T19:00:02.549Z", "datePublished": "2026-09-16T08:24:15.058Z", "dateUpdated": "2026-09-16T08:24:15.058Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.MPP.Plug'"], "packageName": "mpp", "packageURL": "pkg:hex/mpp", "product": "mpp", "programFiles": ["lib/mpp/plug.ex"], "programRoutines": [{"name": "'Elixir.MPP.Plug':call/2"}], "repo": "https://github.com/ZenHive/mpp", "vendor": "ZenHive", "versions": [{"lessThan": "0.16.2", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.MPP.Plug'"], "packageName": "zenhive/mpp", "packageURL": "pkg:github/zenhive/mpp", "product": "mpp", "programFiles": ["lib/mpp/plug.ex"], "programRoutines": [{"name": "'Elixir.MPP.Plug':call/2"}], "repo": "https://github.com/ZenHive/mpp", "vendor": "ZenHive", "versions": [{"lessThan": "2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b", "status": "affected", "version": "2d4d1d94aae7790ae0623063961adbeef171fa71", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Reachable only where the application mounted behind <code>MPP.Plug</code> sets its own <code>Cache-Control</code> on the paid resource, overriding the <code>private</code> the library wrote, and a shared HTTP cache (CDN or reverse proxy) sits in front of that route. An application that sets no <code>Cache-Control</code> of its own keeps the library's <code>private</code> and is not affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "Reachable only where the application mounted behind `MPP.Plug` sets its own `Cache-Control` on the paid resource, overriding the `private` the library wrote, and a shared HTTP cache (CDN or reverse proxy) sits in front of that route. An application that sets no `Cache-Control` of its own keeps the library's `private` and is not affected."}], "value": "Reachable only where the application mounted behind MPP.Plug sets its own Cache-Control on the paid resource, overriding the private the library wrote, and a shared HTTP cache (CDN or reverse proxy) sits in front of that route. An application that sets no Cache-Control of its own keeps the library's private and is not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.16.2", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "E.FU"}, {"lang": "en", "type": "remediation developer", "value": "E.FU"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-09-15T15:22:44.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid.</p>\n<p><code>MPP.Plug.verify_credential</code> in <code>lib/mpp/plug.ex</code> sets <code>payment-receipt</code> and <code>cache-control: private</code> on the connection before the wrapped application runs, and registers no <code>register_before_send/2</code> callback. <code>Plug.Conn.put_resp_header/3</code> replaces an existing header, so a mounting application that sets its own <code>cache-control</code> on the paid resource (for example <code>public, max-age=3600</code>) silently overrides the <code>private</code> the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its <code>Payment-Receipt</code> and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried <code>Payment-Receipt</code>, issuing a receipt for a response that delivered no resource.</p>\n<p>This issue affects mpp: from 0.1.0 before 0.16.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid.\n\n`MPP.Plug.verify_credential` in `lib/mpp/plug.ex` sets `payment-receipt` and `cache-control: private` on the connection before the wrapped application runs, and registers no `register_before_send/2` callback. `Plug.Conn.put_resp_header/3` replaces an existing header, so a mounting application that sets its own `cache-control` on the paid resource (for example `public, max-age=3600`) silently overrides the `private` the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its `Payment-Receipt` and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried `Payment-Receipt`, issuing a receipt for a response that delivered no resource.\n\nThis issue affects mpp: from 0.1.0 before 0.16.2."}], "value": "Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid.\n\nMPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource.\n\nThis issue affects mpp: from 0.1.0 before 0.16.2."}], "impacts": [{"capecId": "CAPEC-204", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unpaid client requesting the same URL through the shared cache receives the cached paid response, including the <code>Payment-Receipt</code> header issued to the paying client. Operators lose the revenue for every cache hit, and the receipt identifying a paid transaction is disclosed to third parties.</p>"}, {"base64": false, "type": "text/markdown", "value": "An unpaid client requesting the same URL through the shared cache receives the cached paid response, including the `Payment-Receipt` header issued to the paying client. Operators lose the revenue for every cache hit, and the receipt identifying a paid transaction is disclosed to third parties."}], "value": "An unpaid client requesting the same URL through the shared cache receives the cached paid response, including the Payment-Receipt header issued to the paying client. Operators lose the revenue for every cache hit, and the receipt identifying a paid transaction is disclosed to third parties."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-524", "description": "CWE-524 Use of Cache Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-16T08:24:15.058Z"}, "references": [{"name": "GitHub Advisory", "tags": ["related", "vendor-advisory"], "url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-82qh-vrvm-gqvc"}, {"name": "EEF CNA record for CVE-2026-89186", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-89186.html"}, {"name": "OSV record EEF-CVE-2026-89186", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-89186"}, {"name": "Introducing commit 2d4d1d9 in ZenHive/mpp", "tags": ["related"], "url": "https://github.com/ZenHive/mpp/commit/2d4d1d94aae7790ae0623063961adbeef171fa71"}, {"name": "Fix commit 2fd91a5 in ZenHive/mpp", "tags": ["patch"], "url": "https://github.com/ZenHive/mpp/commit/2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b"}], "source": {"discovery": "INTERNAL"}, "title": "mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In the application mounted behind <code>MPP.Plug</code>, stop setting <code>Cache-Control</code> on paid routes so the library's <code>private</code> survives to the response, or set a directive that is itself safe for a shared cache (<code>private</code>, or <code>no-store</code>). Where the application must set its own caching policy, configure the CDN or reverse proxy not to cache responses carrying a <code>Payment-Receipt</code> header.</p>"}, {"base64": false, "type": "text/markdown", "value": "In the application mounted behind `MPP.Plug`, stop setting `Cache-Control` on paid routes so the library's `private` survives to the response, or set a directive that is itself safe for a shared cache (`private`, or `no-store`). Where the application must set its own caching policy, configure the CDN or reverse proxy not to cache responses carrying a `Payment-Receipt` header."}], "value": "In the application mounted behind MPP.Plug, stop setting Cache-Control on paid routes so the library's private survives to the response, or set a directive that is itself safe for a shared cache (private, or no-store). Where the application must set its own caching policy, configure the CDN or reverse proxy not to cache responses carrying a Payment-Receipt header."}]}}}

{}

{}

{}

{}