Is CVE-2026-15076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15076 being exploited in the wild.

How severe is CVE-2026-15076?

Informational severity, with a CVSS score of 8.2, published 14 July 2026.

Which products and versions are affected?

Eclipse Foundation Vert.x Web Client <= 4.5.29, <= 5.1.4.

Is there a fix for CVE-2026-15076?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15076 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15076?

Check whether you run Eclipse Foundation Vert.x Web Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15076: Eclipse Vert.x Web Client cross-domain cookie injection in WebClientSession

Q: Is there a fix for CVE-2026-15076?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15076 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-15076?

Check whether you run Eclipse Foundation Vert.x Web Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15076 · Severity: info · CVSS 8.2 · Published 2026-07-14

Eclipse Vert.x is a toolkit for building reactive applications on the Java Virtual Machine. A security flaw in its Web Client component allows a malicious server to 'plant' cookies for other, unrelated websites. If an application using this library connects to a server controlled by an attacker, the attacker can force the application to send the attacker's session information to a legitimate third-party service (like a payment processor), potentially allowing the attacker to capture sensitive transaction data or hijack the user's interaction with that service.

Vendors: Eclipse Foundation.

Quick answers

Is CVE-2026-15076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15076 being exploited in the wild.
How severe is CVE-2026-15076?: Informational severity, with a CVSS score of 8.2, published 14 July 2026.
Which products and versions are affected?: Eclipse Foundation Vert.x Web Client <= 4.5.29, <= 5.1.4.
Is there a fix for CVE-2026-15076?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15076 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15076?: Check whether you run Eclipse Foundation Vert.x Web Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the WebClientSession component of Eclipse Vert.x Web Client (versions up to 4.5.29 and 5.1.4) due to improper origin validation (CWE-346). The component fails to verify that the 'Domain' attribute in a 'Set-Cookie' response header matches the domain of the originating server, violating RFC 6265. An attacker controlling a server contacted by the victim application can inject cookies scoped to any third-party domain. When the application later communicates with that targeted domain using the same session, it transmits the attacker-controlled cookie. This can lead to session fixation or account shadowing, where the victim's requests (potentially containing sensitive API payloads or payment data) are processed under the attacker's session context on the target service.

Affected products

Eclipse Foundation Eclipse Vert.x Web Client <= 4.5.29, <= 5.1.4

Timeline

2026-07-14: advisory: NVD publication date

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.