CVE-2026-47848: Reactor Netty Credential Leak Vulnerability

CVE-2026-47848 is a credential leak flaw in Reactor Netty WebSocket client affecting handshake redirects. Attackers may obtain leaked credentials during cross-origin redirects. This article covers technical details, affected versions from 1.0.52 to 1.3.6, potential impact, and mitigation strategies.

CVE-2026-47848 Overview

CVE-2026-47848 is a credential exposure vulnerability in the Reactor Netty WebSocket client. When the HTTP client is explicitly configured to follow redirects, a WebSocket handshake redirect to a different origin can cause the client to forward authentication credentials to the new origin. This exposes credentials intended for the original destination to an unintended third-party host.

The flaw affects Reactor Netty versions 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier. Exploitation requires an attacker-controlled or attacker-influenced redirect target and a client configured with redirect-following enabled.

Critical Impact
Credentials attached to WebSocket handshake requests may be sent to a foreign origin, enabling credential theft and downstream account compromise.

Affected Products

Reactor Netty 1.3.0 through 1.3.6
Reactor Netty 1.1.0 through 1.2.18
Reactor Netty 1.0.52 and earlier

Discovery Timeline

2026-08-26 - CVE-2026-47848 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-47848

Vulnerability Analysis

The vulnerability resides in the WebSocket handshake handling of the Reactor Netty HTTP client. WebSocket connections begin with an HTTP upgrade request that may include authentication headers such as Authorization or cookies. When the server responds with an HTTP redirect (3xx) pointing to a different origin, and the client has redirect-following enabled, the client reissues the upgrade request against the new host.

During this redirect, credential-bearing headers are not stripped when the target origin differs from the original. The information disclosure occurs at the transport layer, before any application-level authorization logic runs. The issue falls into the Information Exposure category, specifically insecure handling of sensitive headers across origin boundaries.

Root Cause

The root cause is missing origin comparison logic in the redirect handler for WebSocket handshakes. Standard HTTP clients typically drop Authorization headers and origin-scoped cookies when redirecting to a different scheme, host, or port. Reactor Netty's WebSocket path did not enforce this sanitization consistently, allowing credentials to cross the origin boundary.

Attack Vector

An attacker who controls a WebSocket endpoint, or who can influence the server's redirect target through open redirect flaws or DNS manipulation, can capture forwarded credentials. Exploitation requires user interaction in the sense that the vulnerable client must initiate a WebSocket connection to an attacker-influenced URL while configured to follow redirects.

No public proof-of-concept exists. The vulnerability mechanism is described in the Spring Security advisory for CVE-2026-47848.

Detection Methods for CVE-2026-47848

Indicators of Compromise

Outbound WebSocket handshake requests followed by 3xx redirects to unexpected external hosts.
Presence of Authorization headers or session cookies in HTTP traffic destined for hosts outside the application's approved WebSocket endpoints.
Application logs showing WebSocket upgrade retries against a different origin than originally requested.

Detection Strategies

Inspect application dependency manifests (pom.xml, build.gradle) for vulnerable Reactor Netty versions and flag builds that pin affected ranges.
Review HTTP client construction code for calls that enable followRedirect(true) on Reactor Netty HttpClient instances used for WebSocket connections.
Deploy egress network monitoring to identify WebSocket handshakes redirected across origin boundaries.

Monitoring Recommendations

Alert on WebSocket handshake traffic whose Host header changes between the initial request and any follow-up request within the same client session.
Correlate outbound redirects with unusual destination domains using threat intelligence feeds.
Log the full redirect chain for outbound WebSocket connections to support post-incident credential rotation decisions.

How to Mitigate CVE-2026-47848

Immediate Actions Required

Upgrade Reactor Netty to a patched release above 1.3.6, 1.2.18, or 1.0.52 depending on the branch in use.
Audit all HTTP client configurations and disable followRedirect for WebSocket clients that transmit credentials.
Rotate any credentials that may have been exposed through redirect-following WebSocket clients in production traffic.

Patch Information

Refer to the Spring Security advisory for the fixed version list and upgrade guidance. The fix enforces origin comparison during WebSocket redirect handling and strips credential-bearing headers when the target origin differs from the original.

Workarounds

Disable automatic redirect following on Reactor Netty HTTP clients used for WebSocket connections until upgrading is possible.
Enforce an egress allowlist that restricts WebSocket connections to known, trusted endpoints.
Remove Authorization headers from WebSocket handshake requests when the client cannot be upgraded, and rely on post-handshake application-level authentication instead.