CVE-2026-15076: Eclipse Vert.x CSRF Vulnerability

CVE-2026-15076 Overview

CVE-2026-15076 is a cross-domain cookie injection flaw in the WebClientSession component of Eclipse Vert.x Web Client. The component fails to validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, violating RFC 6265 section 5.3. An attacker who controls any server the victim application contacts can inject a cookie scoped to an arbitrary third-party domain. The session store persists and later transmits that cookie to the targeted domain, causing requests to execute under the attacker's account. Sensitive payloads such as payment amounts, card details, or other API data may then be accessible to the attacker.

Critical Impact
Attackers can hijack authenticated sessions by injecting cross-domain cookies, exposing payment data, API keys, and other sensitive payloads to attacker-controlled accounts on trusted third-party services.

Affected Products

Eclipse Vert.x Web Client 4.x branch up to and including 4.5.29
Eclipse Vert.x Web Client 5.x branch up to and including 5.1.4
Applications using the WebClientSession component for HTTP session management

Discovery Timeline

2026-07-14 - CVE-2026-15076 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15076

Vulnerability Analysis

The flaw is classified as an origin validation error [CWE-346]. The WebClientSession class in Eclipse Vert.x Web Client acts as a client-side cookie jar, storing cookies received from HTTP responses and replaying them on subsequent requests. RFC 6265 section 5.3 requires user agents to reject any Set-Cookie header whose Domain attribute does not match or is not a parent of the origin server's domain. WebClientSession skips this check entirely.

When the victim application later sends a request to the targeted domain using the same WebClientSession instance, the attacker-controlled cookie is attached. The receiving service treats the request as authenticated under the attacker's identity, causing the victim's data to be written into the attacker's account.

Root Cause

The session store performs no cross-domain ownership check when persisting cookies from response headers. Any host contacted by the client can set cookies scoped to any domain, including domains for services the victim will contact later using the same session object.

Attack Vector

Exploitation requires the victim application to make an HTTP request to any attacker-controlled server using a shared WebClientSession. The attacker's server responds with a header such as Set-Cookie: sessionid=attacker_value; Domain=payments.example.com. When the application later calls payments.example.com using the same session, it presents the injected cookie. The targeted service then processes subsequent transactions under the attacker's account, allowing exfiltration of any request payload the victim sends.

Refer to the Eclipse CVE Assignment Work Item for the vendor's technical details.

Detection Methods for CVE-2026-15076

Indicators of Compromise

Outbound HTTP responses containing Set-Cookie headers with Domain attributes referencing hosts other than the responding server
WebClientSession cookie stores containing cookies whose Domain values do not match any host the session has previously contacted
Unexpected authenticated API calls to third-party services originating from Vert.x-based applications

Detection Strategies

Instrument Vert.x applications to log the Domain attribute of every stored cookie and compare it against the response origin
Inspect network telemetry for Set-Cookie headers whose Domain value is not a suffix of the responding host
Audit dependency manifests for io.vertx:vertx-web-client versions at or below 4.5.29 or 5.1.4

Monitoring Recommendations

Forward application HTTP logs and JVM dependency inventories into a centralized data lake for continuous version and behavior analysis
Alert on authenticated third-party API calls that immediately follow requests to newly seen or low-reputation hosts
Use the Singularity Platform to correlate process, network, and application telemetry from Vert.x hosts and surface anomalous outbound HTTP session behavior

How to Mitigate CVE-2026-15076

Immediate Actions Required

Upgrade Eclipse Vert.x Web Client to a fixed release above 4.5.29 in the 4.x branch or above 5.1.4 in the 5.x branch
Audit all uses of WebClientSession in application code and identify sessions that contact more than one external domain
Rotate credentials and session tokens for any downstream service that may have received injected cookies

Patch Information

The issue is tracked in the Eclipse CVE Assignment Work Item 162. Consult the Eclipse Vert.x release notes for the specific patched versions on each supported branch and update the io.vertx:vertx-web-client dependency in Maven or Gradle build files accordingly.

Workarounds

Use a separate WebClientSession instance per external domain so cookies cannot cross service boundaries
Wrap outbound calls with a custom cookie filter that discards Set-Cookie headers whose Domain attribute does not match the response origin
Restrict outbound HTTP destinations through an egress proxy allowlist to reduce attacker-controlled response paths

bash

# Maven dependency update example
mvn versions:use-dep-version -Dincludes=io.vertx:vertx-web-client -DdepVersion=<patched-version> -DforceVersion=true
mvn dependency:tree | grep vertx-web-client