CVE-2026-77711 & CVE-2026-76184: Jetty HttpClient Credential Leaks

On October 15, 2026, the Eclipse Foundation disclosed four more vulnerabilities in Eclipse Jetty, this time in the HTTP client, request forwarding, and session persistence: CVE-2026-77711 (8.2 High, CWE-200), CVE-2026-76184 (8.2 High, CWE-200), CVE-2026-76182 (6.9 Medium, CWE-74), and CVE-2026-19864 (5.6 Medium, CWE-312). Three of the four leak credentials: proxy credentials sent to origin servers, Authorization headers following unnormalized redirects, and plaintext passwords written to persisted session stores. The fourth injects query parameters through forwarding templates. Upstream fixes shipped in Jetty 12.0.39 and 12.1.13; Jetty 9.4, 10, and 11 are end of life with no OSS fix available and are patched in NES (Never-Ending Support) for Jetty. All four CVEs affect Jetty 9.4.0 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38, and 12.1.0 through 12.1.12.

Affected and unsupported? See NES for Jetty.

What are the four Eclipse Jetty credential exposure and parameter injection CVEs?

These four advisories are the second half of the eight Jetty CVEs the Eclipse Foundation published on October 15, 2026. The first half, an authorization bypass and SSRF batch, is covered under Related Jetty CVEs below. Where that batch broke the server's security constraint enforcement, this group leaks secrets: two of the flaws sit in HttpClient, the client side of Jetty that backend services use for outbound and proxied requests, one in the handlers that rewrite and forward requests, and one in how authenticated sessions are persisted.

CVE-2026-77711: HttpClient sends proxy credentials to origin servers

Per the upstream advisory, when Jetty's HttpClient makes a request to a server through a forward proxy, the origin server can reply with a 407 (Proxy Authentication Required). The client mistakenly treats the 407 as coming from the proxy and re-sends the request with the proxy credentials attached, delivering them to the origin server. Any server your client talks to through an authenticated proxy can harvest the proxy credentials by returning a single status code. CWE-200 (exposure of sensitive information), scored 8.2 High by the Eclipse Foundation.

CVE-2026-76184: Unnormalized redirects leak Authorization headers

HttpClient can receive a redirect of the form /secure/../evil. Per GHSA-qfr2-43g5-g768, the client matches its stored authentication credentials against /secure instead of normalizing the path to /evil, then follows the redirect and sends the Authorization header for /secure to /evil. Exploitation requires the attacker to control the redirect and to have an application deployed on the same domain as the target, which is the reason for the High attack complexity in the vector. CWE-200, scored 8.2 High.

CVE-2026-76182: Query parameter injection through TryPathsHandler templates

TryPathsHandler and TryFilesFilter can forward requests to template URIs such as index?p=$path, where $path is the request path. Per GHSA-4hxv-32vm-5h2m, paths may contain characters that are reserved in URI queries, so a request path of /s&a=1 expands the template to index?p=/s&a=1, which the receiving application parses as two query parameters (p=/s and a=1) instead of one. An attacker controls extra parameters in the forwarded request. CWE-74 (injection), scored 6.9 Medium.

CVE-2026-19864: Plaintext passwords persisted in session stores

Jetty's SessionAuthentication retains authentication credentials in a serializable object. Per GHSA-q6wx-j9wr-fj7f, when the credentials contain a plaintext password and the session is persisted to a session data store, the password is written to persistent storage in plaintext. Anyone with read access to the persisted session data obtains the plaintext passwords of authenticated users. The flaw lives in jetty-security. CWE-312 (cleartext storage of sensitive information), scored 5.6 Medium. Unlike the other three, this one is local: the vector requires high privileges and access to the session store, so the risk concentrates in database dumps, backups, and shared session infrastructure.

How severe are the four Jetty CVEs?

All four scores come from the Eclipse Foundation as the assigning CNA, on CVSS 4.0, and HeroDevs independently recomputed each base score from its vector. As of October 20, 2026, NVD lists all four as awaiting analysis, so the CNA scores are authoritative.