CVE-2026-15076 Other in Eclipse Vert.x
Attackers can inject cookies into the Vert.x WebClientSession, causing sensitive data to be sent to attacker-controlled accounts on third-party services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15076?
CVE-2026-15076 is a high-severity vulnerability in Eclipse Vert.x, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain.
When the victim application subsequently sends a request to the targeted domain using the same WebClientSession, it presents the attacker-injected cookie, causing the receiving service to process the request under the attacker's account. Sensitive data included in the victim application's requests, such as payment amounts, card details, or other API payloads, may then be accessible to the attacker through their own account on that service.
Weakness: CWE-346
Which versions are affected by CVE-2026-15076?
It affects 1 product.
Products include Eclipse Vert.x.
How do I fix CVE-2026-15076?
No fix has been published for CVE-2026-15076 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15076 being exploited?
There is no known exploitation of CVE-2026-15076 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
Sources
Also known as GHSA-vjx2-fp9g-q2mc.