Authorization Header Leak in Eclipse Vert.x via Redirect

Executive Summary

CVE-2026-15075 is a vulnerability in Eclipse Vert.x, affecting versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch). The issue lies in the DefaultRedirectHandler component of vertx-core, which handles HTTP 30x redirects.

When a request is redirected to a different origin (cross-origin), the DefaultRedirectHandler propagates all request headers from the original request to the redirect target without performing any validation of the redirect destination's origin (scheme, host, or port). The only header stripped during this process is Content-Length.

This means sensitive credential headers such as Authorization, Cookie, Proxy-Authorization, and custom headers like X-API-Token are forwarded to the redirect destination without the caller's knowledge or consent.

An attacker can exploit this by tricking a Vert.x HttpClient into issuing a request that gets redirected to an attacker-controlled host. For example, this could happen if the attacker supplies a URL to a webhook dispatcher, image proxy, or microservice URL fetcher. The attacker can then capture sensitive credentials like bearer tokens, basic-auth credentials, session cookies, and API keys from the original request.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires identifying whether your system is using a vulnerable version of Eclipse Vert.x and monitoring for unintended header propagation during HTTP redirects.

• Check the version of Eclipse Vert.x in use. The vulnerability affects versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch). You can verify the version by inspecting your project dependencies or running commands like `mvn dependency:tree` for Maven projects or `gradle dependencies` for Gradle projects.
• Monitor network traffic for unexpected header propagation during HTTP 30x redirects. Tools like Wireshark, tcpdump, or Burp Suite can be used to inspect HTTP requests and responses. Look for sensitive headers (e.g., Authorization, Cookie, Proxy-Authorization, X-API-Token) being forwarded to unintended destinations.
• Example tcpdump command to capture HTTP traffic: `tcpdump -i any -s 0 -A 'tcp port 80 or tcp port 443' | grep -E 'Authorization|Cookie|Proxy-Authorization|X-API-Token'`. This will filter for sensitive headers in network traffic.
• Test for the vulnerability by crafting a request to a service using Vert.x HttpClient that triggers a cross-origin redirect. Observe whether sensitive headers are forwarded to the redirect target. For example, use a tool like curl to send a request with a custom header and check if it appears in the redirected request: `curl -v -H 'X-API-Token: test' http://your-vertx-service/redirect-endpoint`.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several serious impacts if you are using affected versions of Eclipse Vert.x in your applications or services.

• Exposure of sensitive credentials: If your application sends requests containing sensitive headers (e.g., Authorization, Cookie, or API keys), an attacker could intercept these credentials if the request is redirected to a malicious host.
• Unauthorized access: Attackers could use the captured credentials to gain unauthorized access to protected resources, services, or user accounts associated with the intercepted credentials.
• Data breaches: If the intercepted credentials provide access to sensitive data (e.g., personal information, financial data, or proprietary business data), this could lead to a data breach.
• Compromised services: If the intercepted credentials are used to authenticate to internal or third-party services, attackers could manipulate or disrupt those services.

The impact is particularly severe if your application handles high-value credentials or processes sensitive data, as this vulnerability could be exploited without the user's knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with various standards and regulations, depending on the nature of the data and systems involved.

• GDPR (General Data Protection Regulation): If the intercepted credentials or data include personal data of EU citizens, this vulnerability could lead to a data breach. Under GDPR, organizations must implement appropriate technical measures to protect personal data. Failure to do so could result in fines of up to 4% of global annual revenue or €20 million, whichever is higher. Additionally, organizations are required to report breaches within 72 hours, which could lead to reputational damage.
• HIPAA (Health Insurance Portability and Accountability Act): If the intercepted data includes protected health information (PHI), this vulnerability could result in a HIPAA violation. HIPAA requires covered entities to implement safeguards to protect PHI. A breach could lead to fines ranging from $100 to $50,000 per violation, with a maximum penalty of $1.5 million per year for each violation.
• PCI DSS (Payment Card Industry Data Security Standard): If the intercepted credentials or data include payment card information, this vulnerability could lead to non-compliance with PCI DSS. Organizations handling payment card data must ensure the security of cardholder data. Non-compliance can result in fines, increased transaction fees, or even the loss of the ability to process payment cards.
• Other regulations: Depending on the industry and jurisdiction, other regulations such as the California Consumer Privacy Act (CCPA), the Federal Information Security Management Act (FISMA), or sector-specific regulations may also be impacted. Non-compliance could result in legal penalties, loss of business licenses, or other enforcement actions.

In summary, this vulnerability could lead to non-compliance with regulations that require the protection of sensitive data, potentially resulting in financial penalties, legal consequences, and reputational harm.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Eclipse Vert.x to a patched version as soon as it is available. The fix is planned for release early next week, so monitor the official Eclipse Vert.x releases or security advisories for updates.
• If upgrading is not immediately possible, avoid using the `DefaultRedirectHandler` in your Vert.x HttpClient configurations. Implement a custom redirect handler that explicitly strips sensitive headers before forwarding requests to redirect targets.
• Restrict the use of sensitive headers in requests that may be subject to redirects. For example, avoid including Authorization, Cookie, or custom API tokens in requests that could be redirected to untrusted hosts.
• Validate and sanitize all URLs and redirect targets in your application to ensure they point to trusted destinations. Avoid accepting user-supplied URLs that could trigger redirects to attacker-controlled hosts.
• Monitor and log HTTP redirects in your application to detect any suspicious activity, such as unexpected header propagation or redirects to unknown hosts.

Useful 0 Not Useful 0