CVE-2026-15075: Eclipse Vert.x Information Disclosure Flaw

CVE-2026-15075 Overview

CVE-2026-15075 is an information disclosure vulnerability in Eclipse Vert.x affecting versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch). The DefaultRedirectHandler in vertx-core forwards all request headers, including credential-bearing headers, across cross-origin HTTP 30x redirects. The handler strips only Content-Length and performs no origin comparison of scheme, host, or port before propagating headers. Attackers who can influence a Vert.x HttpClient request target can capture Authorization, Cookie, Proxy-Authorization, and custom credential headers such as X-API-Token. This weakness maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Bearer tokens, session cookies, basic-auth credentials, and API keys can be leaked to attacker-controlled hosts through unvalidated HTTP redirect chains.

Affected Products

Eclipse Vert.x vertx-core versions up to and including 4.5.29 (4.x branch)
Eclipse Vert.x vertx-core versions up to and including 5.1.4 (5.x branch)
Applications and microservices using Vert.x HttpClient with automatic redirect following enabled

Discovery Timeline

2026-07-14 - CVE CVE-2026-15075 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15075

Vulnerability Analysis

The defect lives in DefaultRedirectHandler, the component that handles HTTP 30x responses inside vertx-core. When the client follows a redirect, the handler copies the original request headers verbatim to the new request. Only the Content-Length header is removed to reflect the new request body state. No logic compares the origin of the initial request against the origin of the redirect target. As a result, sensitive headers scoped to the original host are transmitted to any host the redirect points to, including hosts controlled by an attacker.

Root Cause

The root cause is missing origin validation before header propagation on redirects [CWE-200]. Well-behaved HTTP clients strip authentication and cookie headers when the redirect target differs from the original origin in scheme, host, or port. The Vert.x redirect path skips this check entirely and treats all headers as safe to forward. Callers who supply credentials to a trusted service have no way to know those credentials will follow the response chain to a different host.

Attack Vector

Exploitation requires the attacker to influence the URL requested by a Vert.x HttpClient. Common conditions include webhook dispatchers, image or link preview proxies, server-side URL fetchers, OAuth callback fetchers, and microservice-to-microservice calls where the target URL is user-supplied. The attacker hosts an endpoint that responds with an HTTP 301, 302, 303, 307, or 308 response pointing to a listener they control. When the Vert.x client follows the redirect, it replays the original Authorization, Cookie, Proxy-Authorization, and custom credential headers to the attacker's endpoint. The attacker then reuses the captured credentials against the legitimate service.

No authentication or user interaction is required on the vulnerable server side; the attacker only needs to control the redirect target host.

Detection Methods for CVE-2026-15075

Indicators of Compromise

Outbound HTTP requests from Vert.x-based services to unexpected external hosts containing Authorization, Cookie, or X-API-Token headers
HTTP 30x responses in application logs whose Location header points to a different scheme, host, or port than the original request
Reuse of bearer tokens or session identifiers from unfamiliar source IP addresses shortly after outbound webhook or fetcher activity

Detection Strategies

Enumerate application dependencies for io.vertx:vertx-core at versions <= 4.5.29 or <= 5.1.4 using software composition analysis tooling
Inspect application code for HttpClientOptions.setFollowRedirects(true) or per-request setFollowRedirects(true) combined with user-supplied URLs
Instrument egress proxies to flag cross-origin redirect chains that carry credential headers end-to-end

Monitoring Recommendations

Log outbound HTTP redirect targets and compare origin tuples (scheme, host, port) against the original request destination
Alert on outbound traffic from backend services to newly observed domains, especially when carrying authorization material
Track token issuance events and correlate against outbound HTTP flows to detect credential replay from unexpected origins

How to Mitigate CVE-2026-15075

Immediate Actions Required

Upgrade io.vertx:vertx-core to a fixed release once published by the Eclipse Vert.x project; monitor the Eclipse CVE Assignment Work Item #161 for fix version information
Rotate any long-lived credentials, API tokens, and session cookies that may have been sent through Vert.x HttpClient requests to attacker-influenced URLs
Audit code paths where user-controlled URLs are fetched by Vert.x services and disable automatic redirect following where feasible

Patch Information

Refer to the Eclipse CVE Assignment Work Item #161 for authoritative patch and version guidance. Applications on the 4.x branch should track a release beyond 4.5.29, and applications on the 5.x branch should track a release beyond 5.1.4.

Workarounds

Disable automatic redirect handling by calling HttpClientOptions.setFollowRedirects(false) and implement a custom redirect handler that strips Authorization, Cookie, Proxy-Authorization, and custom credential headers when the target origin differs from the source origin
Restrict outbound egress from services that perform URL fetching to an allow-list of known destinations enforced at the network layer
Apply URL validation before dispatch to reject targets outside a defined set of trusted hosts, preventing attacker-controlled redirect chains from starting

bash

# Example: disable automatic redirect following in Vert.x HttpClient (Java)
# HttpClientOptions options = new HttpClientOptions().setFollowRedirects(false);
# HttpClient client = vertx.createHttpClient(options);
# Implement manual redirect logic that strips credential headers on cross-origin hops.