CVE-2026-76184 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for systems using Eclipse Jetty's HttpClient for authentication should assess exposure and verify affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize remediation efforts based on the potential impact of authentication credentials being sent to an attacker-controlled location.

Why it matters

CVE-2026-76184 is a high-severity vulnerability in Eclipse Jetty's HttpClient, which can lead to authentication credentials being sent to an attacker-controlled location. Defenders should assess exposure, particularly in systems using Jetty's HttpClient for authentication. The vulnerability requires verification of affected versions and remediation priority. Evidence is limited, and further verification is needed to determine the full scope of the vulnerability.

• Authentication credentials may be sent to an attacker-controlled location
• Attacker must have an evil application deployed on the same domain as the target
• Verification of affected versions is necessary
• Remediation priority is high due to the potential for authentication compromise

Technical summary

CVE-2026-76184 is a high-severity vulnerability in Eclipse Jetty's HttpClient. An attacker can control redirects, causing HttpClient to send authentication credentials to an attacker-controlled location. The attacker must have an evil application deployed on the same domain as the target. This vulnerability requires verification of affected versions and remediation priority. The CVE record indicates that HttpClient matches authentication credentials against the redirect target rather than normalizing the path, leading to potential authentication compromise.

Defensive priority

High

Recommended defensive actions

• Verify if the system uses Eclipse Jetty's HttpClient for authentication
• Assess exposure to the vulnerability
• Check for vendor-provided patches or updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is needed to determine the full scope of the vulnerability and affected systems. Evidence is limited, and defenders should verify affected versions, assess exposure, and prioritize remediation. Limited source detail suggests an evil application must be on the same domain as the target, but additional verification is required to confirm this and other aspects of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.