Read the docs
TI-2026-12690 Aliases CVE-2026-15075

Information disclosure in Eclipse Vert.x

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 12 fixed, 9 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200 and CWE-346.

Summary

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge. An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Partial Red Hat: 12 advisoriesRed Hat: 12 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Vert.x4.0.0 – 4.5.29; 5.0.0 – 5.1.4—No fix listedCNA
  • Eclipse Vert.x VendorEclipse Foundation Affected 4.0.0 – 4.5.29; 5.0.0 – 5.1.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*up to 4.5.29; 5.0.0 – 5.1.4VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions up to 4.5.29; 5.0.0 – 5.1.4 Vulnerable ·Eclipse Foundation

Remediation

Red Hat 12 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:70421 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 XP 6.0.6.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
Show 9 more Red Hat advisories
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:50846 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.14 Security Update
    • Red Hat build of Keycloak 26.4.14
  • RHSA-2026:50848 Released 2026-08-05 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.5 Security Update
    • Red Hat build of Keycloak 26.6.5
  • RHSA-2026:48118 Released 2026-07-30 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
    • Red Hat Build of Apache Camel 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +9
  • RHSA-2026:47172 Released 2026-07-30 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.2.SP3 security update
    • Red Hat build of Quarkus 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +3
  • RHSA-2026:47189 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.4.SP3 security update
    • Red Hat build of Quarkus 3.27.4.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Red Hat Build of Apache Camel 3.33.2.SP3Fixed RHSA-2026:48118
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:70421
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Keycloak 26.4.14Fixed RHSA-2026:50846
Red Hat build of Keycloak 26.6.5Fixed RHSA-2026:50848
Red Hat build of Quarkus 3.27.4.SP3Fixed RHSA-2026:47189
Red Hat build of Quarkus 3.33.2.SP3Fixed RHSA-2026:47172
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 14 products
  • Cryostat 4 on RHEL 9
  • Red Hat Build of Apache Camel 3.33.2.SP3
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat build of Quarkus 3.27.4.SP3
  • Red Hat build of Quarkus 3.33.2.SP3
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15075
  2. 2026-10-09 Fix available: RHSA-2026:48118 · Red Hat
  3. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.2.SP3 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1, Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-20 Fix available: RHSA-2026:70421 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:50846 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:50848 · Red Hat
  10. 2026-10-23 Fix available: Red Hat build of Keycloak 26.4.14, Red Hat build of Keycloak 26.6.5 · Red Hat
  11. 2026-11-03 Affected versions changed · Red Hat

References

Other 1

  • TI-2026-06017 Improper certificate validation in Eclipse Vert.x CVSS 4.0MEDIUM 6.9
  • TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler… CVSS 4.0MEDIUM 6.3
  • TI-2019-13165 Path traversal in Eclipse Vert.x CVSS 3.1CRITICAL 9.8
  • TI-2018-09003 XML external entity injection in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
  • TI-2018-09001 Path traversal in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
  • TI-2025-10972 Cross-site scripting in Eclipse Foundation Vert.x CVSS 4.0LOW 2.3
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences