Key points
- CVE-2026-76184 allows credential leakage via malformed redirects in Eclipse Jetty HttpClient.
- The flaw affects Jetty versions up to 12.1.12, 12.0.38, 11.0.32 and 10.0.32.
- Attackers must control an application on the same domain to exploit the vulnerability.
Eclipse Jetty HttpClient contains a vulnerability that leaks authentication credentials when processing specific redirect responses. The flaw, tracked as CVE-2026-76184, allows an attacker to intercept sensitive authorization headers if they can control redirect destinations on the same domain.
The National Vulnerability Database rates the issue as high severity with a CVSS score of 8.2. The weakness stems from how the client handles path normalization during redirects. When the client receives a redirect, it may match authentication credentials against the original path rather than the normalized destination.
Context and background
The vulnerability is classified under CWE-200, which relates to exposure of sensitive information. According to the NVD record, the HttpClient component fails to properly normalize paths before applying authentication rules. This mismatch causes the client to send credentials intended for a secure path to a different, potentially malicious endpoint.
Who is affected
The flaw impacts multiple versions of the Eclipse Jetty server software. Affected releases include versions up to 12.1.12, up to 12.0.38, up to 11.0.32 and up to 10.0.32. Organizations using any of these versions in their infrastructure are exposed to this credential theft risk.
Next steps
No patch or fix has been confirmed yet in the source material. Administrators should verify which versions of Eclipse Jetty are running in their environments. Teams should check if any applications using the HttpClient component are susceptible to controlled redirects from the same domain.
Signals worth monitoring
Teams usually detect this activity by reviewing HTTP request logs for unexpected redirect patterns. Check whether authorization headers are being sent to endpoints that do not match the original request path. Look for sequences where a client follows a redirect to a different path on the same domain while retaining credentials. Monitor for applications receiving authentication data for paths they did not originally request. Investigate any internal services that handle redirects from untrusted sources within the same domain boundary. Review proxy logs for discrepancies between the initial request URL and the final destination URL when credentials are present.
What to do and how to stay safe: Eclipse Jetty
- Audit all instances of Eclipse Jetty to identify versions listed as affected in the CVE record.
- Review application logs for redirect sequences that involve path traversal patterns like dot-dot-slash.
- Monitor for authorization headers being sent to endpoints that differ from the initial request path.
- Restrict redirect capabilities in applications where possible to prevent attackers from controlling destination paths.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-76184?
The National Vulnerability Database assigns a CVSS score of 8.2, which is rated as high severity.
Which versions of Eclipse Jetty are vulnerable?
Versions up to 12.1.12, up to 12.0.38, up to 11.0.32 and up to 10.0.32 are affected by this flaw.
Can an attacker exploit this from a different domain?
No, the attacker must have an application deployed on the same domain as the target to exploit this vulnerability.
