CVE-2026-76184: Eclipse Jetty Authentication Bypass Vulnerability

CVE-2026-76184 Overview

CVE-2026-76184 is an information disclosure vulnerability in Eclipse Jetty's HttpClient. The client fails to normalize redirect paths before matching stored authentication credentials. When HttpClient receives a redirect such as /secure/../evil, it matches credentials against the literal /secure prefix instead of the normalized /evil path. As a result, HttpClient follows the redirect and forwards the Authorization header for /secure to /evil. An attacker who controls redirects and operates an application on the same domain as the target can harvest credentials belonging to another path on that domain.

Critical Impact

Attackers who control redirect responses on a shared domain can capture Authorization headers intended for a protected path, leading to credential disclosure.

Affected Products

• Eclipse Jetty HttpClient
• Applications embedding Jetty HttpClient for outbound HTTP calls
• Multi-tenant deployments hosting attacker-controlled applications on the same domain as targets

Discovery Timeline

• 2026-10-15 - CVE-2026-76184 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-76184

Vulnerability Analysis

The flaw is an information exposure issue tracked under [CWE-200]. Jetty's HttpClient stores authentication credentials keyed by request path prefix. When the server returns a redirect, the client should normalize the target path before deciding whether to attach the cached Authorization header. Jetty instead evaluates the raw, unnormalized path. A redirect target of /secure/../evil is treated as matching /secure, so HttpClient attaches the credentials bound to /secure. The HTTP engine then normalizes the path when issuing the request, sending the header to /evil. The result is that credentials cross a trust boundary the client intended to enforce.

Root Cause

The root cause is a path-matching logic error. Credential scoping and request dispatch use different representations of the redirect URI. Credential selection runs against the unnormalized path, while the subsequent request uses the normalized path. This inconsistency breaks the per-path credential isolation that HttpClient is designed to provide.

Attack Vector

Exploitation requires an attacker to control redirect responses and host an application on the same domain as the target endpoint. The attacker induces the victim HttpClient to call a URL under their control, which returns a 3xx redirect pointing to /secure/../evil. HttpClient matches the stored credentials for /secure, normalizes the path, and sends the Authorization header to the attacker-controlled /evil endpoint. The attacker logs the header and reuses the credentials against the legitimate /secure resource. Because the attack is same-domain, cross-origin credential protections do not apply.

No verified proof-of-concept code is published. See the GitHub Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-76184

Indicators of Compromise

• Outbound HTTP requests from Jetty-based services containing Authorization headers directed at unexpected paths on the same domain as a protected resource.
• Redirect responses with Location values containing .. path traversal segments such as /secure/../evil.
• Access log entries on shared-domain applications showing receipt of Authorization headers that were provisioned for a different path.

Detection Strategies

• Inspect proxy and gateway logs for 3xx responses whose Location header contains dot-segment sequences targeting the same host.
• Correlate outbound requests from Jetty HttpClient instances with the destination path and the presence of Authorization headers.
• Enumerate applications deployed under shared domains and flag any that receive Authorization headers scoped to another application.

Monitoring Recommendations

• Alert on redirect chains that cross path boundaries within a single domain, especially where credentials are configured for one path prefix.
• Monitor Jetty release channels and dependency manifests for HttpClient versions that remain unpatched.
• Track authentication failures and successes against the protected /secure-equivalent paths for anomalous source patterns following redirect events.

How to Mitigate CVE-2026-76184

Immediate Actions Required

• Upgrade Eclipse Jetty to the fixed version listed in the GitHub Security Advisory.
• Inventory applications that embed Jetty HttpClient and identify any that follow redirects while sending Authorization headers.
• Review multi-tenant hosting arrangements where untrusted applications share a domain with sensitive endpoints.

Patch Information

Refer to the Eclipse GitLab CVE Assignment and the GitHub Security Advisory for the official fixed versions and patch commits. Apply the fix across all services that use Jetty HttpClient for outbound authenticated requests.

Workarounds

• Disable automatic redirect following in HttpClient where feasible and handle redirects explicitly after validating the normalized target path.
• Scope stored credentials to full URLs rather than path prefixes, and clear credentials before issuing follow-up requests to redirect targets.
• Isolate sensitive applications on dedicated domains so attacker-controlled applications cannot share the credential scope.

# Example: disable redirect following on a Jetty HttpClient instance
httpClient.setFollowRedirects(false);