Read the docs
TI-2026-74691 Aliases CVE-2026-77711

Eclipse Jetty HttpClient leaks proxy credentials to origin servers

Priority HIGH 69CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Eclipse Jetty versions 9.4.0 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38 and 12.1.0 through 12.1.12 are affected. When a server replies with 407 Proxy Authentication Required, the HttpClient wrongly treats it as coming from the forward proxy and resends the request with the Proxy-Authentication header (CWE-200). The server receives the proxy credentials, and a remote server that sends the 407 needs no privileges or user interaction to obtain them.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12; 12.0.0 – 12.0.38; 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64—No fix listedCNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12; 12.0.0 – 12.0.38; 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Eclipse Jetty. Red Hat fixes Red Hat Build of Apache Camel 3.33.4.SP3 in RHSA-2026:95622. Red Hat reports no fix available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Satellite 6 and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:95622 Released 2026-11-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)
    • Red Hat Build of Apache Camel 3.33.4.SP3 com.google.guava.guava-33.7.2.jre-redhat-00002.jar, io.vertx.vertx-grpc-server-4.5.35.redhat-00001.jar, io.vertx.vertx-web-4.5.35.redhat-00001.jar +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.4.SP3Fixed RHSA-2026:95622
Not affected: 5 products
  • Red Hat Build of Apache Camel 3.33.4.SP3
  • Red Hat Fuse 7
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-77711
  2. 2026-10-16 Affected versions changed · Red Hat
  3. 2026-10-16 CVSS score added · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-24 Affected versions changed · Red Hat
  6. 2026-11-03 Affected versions changed · Red Hat
  7. 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.SP3 · Red Hat
  8. 2026-11-06 Fix available: RHSA-2026:95622 · Red Hat

References

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences