Key points
- CVE-2026-76184 affects Eclipse Jetty versions up to 12.1.12, 12.0.38, 11.0.32, and 10.0.32.
- The vulnerability allows an attacker to redirect requests and capture Authorization headers.
- The attacker must control an application on the same domain as the target to exploit this flaw.
Eclipse Jetty users running versions up to 12.1.12, 12.0.38, 11.0.32, or 10.0.32 must address a high-severity authentication leak. The National Vulnerability Database rates CVE-2026-76184 as high severity with a CVSS score of 8.2. The flaw exists in the HttpClient component and involves how the software processes path redirects.
In plain English
When the HttpClient receives a redirect, it may fail to normalize the path correctly. For example, a redirect to `/secure/../evil` might be treated as a request to `/secure`. If the client has stored credentials for that secure path, it sends the Authorization header to the new location. This allows an attacker to intercept valid login tokens.
The background
The vulnerability is classified under CWE-200, indicating an information exposure weakness. According to the NVD record, the issue arises because the client matches credentials against the original path rather than the normalized destination. This behavior occurs only if an attacker can control the redirect mechanism. The attacker must also have a malicious application deployed on the same domain as the victim.
What changes now
Teams using Eclipse Jetty need to verify their current versions against the affected list. Versions up to 12.1.12, 12.0.38, 11.0.32, and 10.0.32 are listed as affected. Any installation at or below these version numbers is at risk. Organizations should check their inventory for these specific builds and monitor for vendor updates that resolve the path normalization issue.
Who needs to act first
Prioritize systems that expose Eclipse Jetty to untrusted networks or handle sensitive user logins. Check whether your applications use HttpClient to connect to external services that might issue redirects. Roll out updates to internet-facing servers first to reduce immediate exposure. Test the updated version in a non-production environment to ensure compatibility with your existing workflows. Back up configuration files before making changes to allow for a quick rollback if issues arise.
What to do and how to stay safe: Eclipse Jetty
- Inventory all systems using Eclipse Jetty to identify those running vulnerable versions.
- Monitor logs for unusual redirect patterns or unexpected authorization header transmissions.
- Restrict HttpClient usage to trusted domains where you control the redirect behavior.
- Wait for the vendor to release a patched version before updating production environments.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Eclipse Jetty are vulnerable?
Versions up to 12.1.12, up to 12.0.38, up to 11.0.32, and up to 10.0.32 are affected.
Can an attacker exploit this from any domain?
No, the attacker must have an application deployed on the same domain as the target.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 8.2, rated as high severity.
