CVE-2026-76184

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76184", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-08-19T10:40:46.320Z", "datePublished": "2026-10-15T08:46:54.683Z", "dateUpdated": "2026-10-15T13:51:45.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-10-15T08:46:54.683Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty:jetty-client", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThanOrEqual": "11.0.32", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.32", "versionType": "semver"}, {"status": "affected", "version": "9.4.0", "lessThanOrEqual": "9.4.64", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, HttpClient may receive a redirect of the form:</p><p>```</p><p>/secure/../evil</p><p>```</p><p>If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.</p><p>This also mean that the attacker must have an evil application deployed on the same domain as the target.</p>"}]}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "https://github.com/4ra1n", "type": "finder"}, {"lang": "en", "value": "https://github.com/pyn3rd", "type": "finder"}, {"lang": "en", "value": "https://github.com/unam4", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T13:51:21.872199Z", "id": "CVE-2026-76184", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:51:45.344Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76184", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-08-19T10:40:46.320Z", "datePublished": "2026-10-15T08:46:54.683Z", "dateUpdated": "2026-10-15T13:51:45.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-10-15T08:46:54.683Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty:jetty-client", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThanOrEqual": "11.0.32", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.32", "versionType": "semver"}, {"status": "affected", "version": "9.4.0", "lessThanOrEqual": "9.4.64", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, HttpClient may receive a redirect of the form:</p><p>```</p><p>/secure/../evil</p><p>```</p><p>If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.</p><p>This also mean that the attacker must have an evil application deployed on the same domain as the target.</p>"}]}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "https://github.com/4ra1n", "type": "finder"}, {"lang": "en", "value": "https://github.com/pyn3rd", "type": "finder"}, {"lang": "en", "value": "https://github.com/unam4", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76184", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T13:51:21.872199Z"}}}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:51:41.700Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty:jetty-client", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.38", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "11.0.32", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.0.32", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.4.64", "status": "affected", "version": "9.4.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target."}], "id": "CVE-2026-76184", "lastModified": "2026-10-15T14:41:34.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76184", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T13:51:21.872199Z", "version": "2.0.3"}}]}, "published": "2026-10-15T09:17:18.443", "references": [{"source": "emo@eclipse.org", "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768"}, {"source": "emo@eclipse.org", "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.eclipse.jetty/jetty-client: org.eclipse.jetty/jetty-http-tools: jetty-client: Information disclosure via improper redirect path normalization", "id": "2553118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553118"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause the client to transmit sensitive authorization headers to an unintended endpoint on the same domain, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\nFixed in: No fixed version identified yet..\nRed Hat recommends updating org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools to the latest version when a fix is available."}, "name": "CVE-2026-76184", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "jetty-client", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-client", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-http-tools", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "jetty-client", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "jetty-client", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "jetty-client", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "maven-site-plugin", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "jmc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "jetty-client", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Out of support scope", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-server", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-15T08:46:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76184\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76184\nhttps://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768\nhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/236"], "statement": "A flaw was found in org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools. In Eclipse Jetty, HttpClient may receive a redirect of the form:\n```\n/secure/../evil\n```\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.\nPrerequisites: Standard deployment configuration\nCVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). None -- NVD score appropriate\nExploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM.\nThis issue affects fedora-all, fuse-7, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-camel-quarkus-3, rhboac-hawtio-4, rhel-7, rhel-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.38]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.32]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.32]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.4.0,9.4.64]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}], "created": "2026-10-16T22:00:16.310150+00:00", "updated": "2026-10-19T14:01:46.400661+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$jetty"]}