CVE-2026-100724
Received Received - Intake

http4k Reverse Proxy Host Header Authorization Bypass

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100724
EUVD
EUVD-2026-87855

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the http4k library's reverseProxy() function before versions 6.49.0.0, 5.42.0.0, and 4.51.0.0. It uses substring matching on the Host header by default, allowing an attacker to bypass routing-based authorization by sending a Host header containing a configured vhost name. For example, a request with Host: admin.evil.com could access a vhost configured as admin.

Detection Guidance

Check http4k library versions in use. Commands like 'mvn dependency:tree' or 'gradle dependencies' can list http4k-core versions. If versions are below 6.49.0.0, 5.42.0.0, or 4.51.0.0, the system is vulnerable. Inspect reverseProxy() or reverseProxyRouting() configurations for public-facing inbound handlers with multiple virtual hosts.

Impact Analysis

If you use http4k's reverseProxy() as a public-facing inbound HTTP handler with multiple virtual hosts, an attacker could exploit this to access unauthorized hosts by manipulating the Host header. This could lead to data exposure, unauthorized actions, or bypassing security controls. Only affects multi-vhost setups; outbound or test-time uses are not impacted.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches, non-compliance with access controls, and potential regulatory penalties due to compromised data integrity and confidentiality.

Mitigation Strategies

Upgrade http4k-core to versions 6.49.0.0, 5.42.0.0, or 4.51.0.0 or later. If substring matching is required, explicitly set matcher=Contains in reverseProxy() or reverseProxyRouting(). For immediate mitigation without upgrading, wrap reverseProxy() with a host-allow-list filter to enforce exact host matching before delegation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart