Eclipse Jetty Flaw Leaks Proxy Credentials via Misinterpreted 407 Errors

Eclipse Jetty contains a high-severity vulnerability that exposes proxy authentication credentials to target servers. The flaw occurs when the HttpClient component misinterprets HTTP 407 responses during requests routed through a forward proxy.

What happened

The National Vulnerability Database records CVE-2026-77711 with a CVSS score of 8.2, classifying it as a high-severity issue. The weakness stems from how Jetty’s HttpClient handles HTTP 407 Proxy Authentication Required responses. When a client sends a request through a forward proxy, the target server may reply with a 407 status code. The client incorrectly assumes this response originates from the proxy rather than the destination server.

Consequently, the client resends the original request, appending the Proxy-Authentication header. This header contains the credentials intended for the proxy. The target server receives these credentials, granting it access to sensitive authentication data. The flaw is categorized under CWE-200, which covers information exposure. This incident follows a previous high-severity flaw, CVE-2026-18661, which allowed security constraint bypasses in mixed configurations for versions up to 12.1.11, as Patch Gazette reported on 2026-10-15.

Why it matters

This vulnerability affects multiple major release lines of Eclipse Jetty. Versions up to 12.1.12, up to 12.0.38, up to 11.0.32, and up to 10.0.32 are all impacted. Organizations using these versions for web applications or services that communicate through forward proxies are at risk. An attacker controlling the target server can harvest proxy credentials. These credentials could potentially be used to access other internal resources protected by the same proxy. The exposure of authentication data undermines the security boundary provided by the proxy infrastructure. Teams must verify if their deployments use affected versions.

What to watch

• Monitor network traffic for unexpected Proxy-Authentication headers reaching target servers.
• Check logs for HTTP 407 responses originating from application servers rather than proxies.
• Review configurations for any services using Jetty HttpClient with forward proxies.
• Watch for vendor announcements regarding patches for CVE-2026-77711.

Who needs to act first

Teams should prioritize systems that use forward proxies for outbound connections. Identify applications running on affected Jetty versions that access external services. Isolate these systems from sensitive internal networks if possible. Implement strict monitoring for credential leakage during proxy interactions. Test any potential mitigations in a non-production environment first. Ensure backup procedures are current before making configuration changes. Evaluate the use of alternative client libraries for critical communications. Coordinate with security operations to detect anomalous authentication attempts.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Eclipse Jetty

• Inventory all instances of Eclipse Jetty to identify versions up to 12.1.12, 12.0.38, 11.0.32, and 10.0.32.
• Restrict outbound proxy usage for applications running vulnerable Jetty versions until a fix is available.
• Monitor server logs for unauthorized access attempts using harvested proxy credentials.
• Plan for migration to newer, unaffected versions once the vendor releases a confirmed update.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Eclipse Jetty are affected by CVE-2026-77711?

Versions up to 12.1.12, up to 12.0.38, up to 11.0.32, and up to 10.0.32 are affected.

Is there a patch available for this vulnerability?

No fix has been confirmed yet by the vendor for CVE-2026-77711.

What type of data is exposed by this flaw?

Proxy authentication credentials are exposed to the target server.