CVE-2026-15075 Information disclosure in Eclipse Vert.x

High 8.2 Published 14 Jul 2026 Updated 14 Jul 2026

Attackers can steal sensitive headers like cookies and tokens when Vert.x clients follow cross-origin redirects due to missing origin checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-15075?

CVE-2026-15075 is a high-severity vulnerability in Eclipse Vert.x, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge.

An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.

Weakness: CWE-346, CWE-200

Which versions are affected by CVE-2026-15075?

It affects 1 product.

Products include Eclipse Vert.x.

How do I fix CVE-2026-15075?

Upgrade to a fixed version.

Is CVE-2026-15075 being exploited?

There is no known exploitation of CVE-2026-15075 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-BZ49747, CLEANSTART-2026-JF57527, CLEANSTART-2026-SB90321, CLEANSTART-2026-ZV89277.