Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-15075

High
8.2/10

Summary

In Eclipse Vert.x versions 4.x through 4.5.29 (4.x branch) and 5.x through 5.1.4 (5.x branch), `DefaultRedirectHandler` (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as `X-API-Token`, are forwarded to the redirect destination without the caller's knowledge. An attacker who can cause a Vert.x `HttpClient` to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request. This vulnerability has been fixed in versions 4.5.30 and 5.1.5.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published