CVE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
Attackers may obtain session cookies passed to backend servers during internal redirects if SessionCookieRemove configuration changes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47360?
CVE-2026-47360 is a high-severity vulnerability in Apache Http Server, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Weakness: CWE-200
Which versions are affected by CVE-2026-47360?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.60 | 2.4.69 |
Products include Apache Http Server.
How do I fix CVE-2026-47360?
Upgrade apache to 2.4.69 or later.
Is CVE-2026-47360 being exploited?
There is no known exploitation of CVE-2026-47360 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2026-47360, AZL-106767, BELL-CVE-2026-47360, BIT-apache-2026-47360, CLSA-2026-1792765962, DEBIAN-CVE-2026-47360 and 5 more.