# CVE-2026-111258: Web application request routing security constraint bypass

Source: https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-111258 · Severity: info · Published 2026-11-10

A web application's optional request routing feature bypasses security constraints when forwarding requests to configured destinations. An attacker can exploit this to reach protected resources or read sensitive application files like configuration and class files. Only web applications with specific routing configurations are vulnerable. Organizations should upgrade to the patched versions immediately.

Technologies: [<UNKNOWN>](https://junglewise.ai/threats/technologies/x-unknown).

## Quick answers

**Is CVE-2026-111258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111258 being exploited in the wild.

**How severe is CVE-2026-111258?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** <UNKNOWN>.

**Is there a fix for CVE-2026-111258?** Yes: fixed in 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111258 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111258?** Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.3.0, 11.0.0-M2

## Technical details

The request routing feature forwards requests to configured destinations without applying the destination's security constraints or protecting the web application's private directories. If a route copies client-controlled parts of the request path into the destination URL, a remote attacker can perform path traversal to access protected resources, read configuration files, or retrieve compiled class files. The vulnerability requires a specific routing configuration to be exploited.

## Affected products

- <UNKNOWN>

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m](https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m)

## Related threats

- [System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under)
- [Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the)
- [Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a)
- [SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to)
- [JAAS login modules credential timing and username enumeration](https://junglewise.ai/threats/cve-2026-86532-the-bundled-jaas-login-modules-leak-whether-a-username-exists-and)