Eclipse Jetty Proxy Credential Exposure: Upstream 407 Errors Cause Client Header Leak in Versions Prior to 12.1.12

Eclipse Jetty contains a high-severity information disclosure flaw that exposes proxy credentials to unintended recipients. The bug occurs when the application’s HTTP client communicates through a forward proxy to reach a target server. If that target server responds with a 407 status code, the client incorrectly assumes the message originated from the proxy itself rather than the final destination.

Root cause

The underlying issue is a logic error in how the Jetty `HttpClient` processes authentication challenges. According to the National Vulnerability Database record for CVE-2026-77711, the client fails to distinguish between a 407 response generated by the intermediary proxy and one generated by the ultimate server. This confusion leads the client to treat the server’s response as a legitimate request for proxy credentials, triggering an automatic retransmission of sensitive data to the wrong endpoint.

Attack path

An adversary controlling or compromising a destination server can exploit this behaviour to steal credentials. By deliberately sending a 407 Proxy Authentication Required response to a connecting Jetty client, the attacker forces the client to resend the request. This subsequent request includes the `Proxy-Authentication` header, which contains the credentials intended for the forward proxy. The destination server then receives and can log these credentials, effectively bypassing the proxy’s security boundary.

Affected versions

The vulnerability impacts multiple supported branches of the software. Affected versions include Eclipse Jetty up to 12.1.12, up to 12.0.38, up to 11.0.32, and up to 10.0.32. Users running any of these specific releases or earlier versions within those branches are exposed to the credential leakage risk described in the advisory.

Mitigation

• Upgrade Eclipse Jetty to the latest patched release available from the Eclipse Foundation.
• Review network logs for unexpected 407 responses originating from destination servers rather than proxies.
• Restrict which servers Jetty clients can connect to, reducing exposure to malicious endpoints.
• Monitor for outbound traffic containing proxy authentication headers to non-proxy destinations.

Signals worth monitoring

Security teams should examine proxy logs for anomalies in authentication challenge flows. Look for 407 responses that do not originate from known proxy infrastructure but from external application servers. Check for repeated connection attempts where the client resends credentials after such errors. Inspect outbound traffic for `Proxy-Authentication` headers being sent to destinations that do not require proxy authentication. Verify that all proxy-related headers are stripped before reaching final servers.

What to do and how to stay safe: Eclipse Jetty

• Audit all applications using Eclipse Jetty to identify versions listed in the affected range.
• Implement strict allow-listing for outbound HTTP connections to minimise exposure to rogue servers.
• Enable detailed logging on proxy servers to detect unexpected authentication requests from internal clients.
• Monitor for unauthorised access attempts using stolen proxy credentials in downstream systems.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific CVE covers this Eclipse Jetty vulnerability?

The flaw is tracked as CVE-2026-77711 in the National Vulnerability Database.

What is the CVSS score for this issue?

The vulnerability has a CVSS score of 8.2, which is rated as HIGH severity.

Does this bug affect the latest version of Jetty 12?

Versions up to 12.1.12 are affected, so users on that release or older are at risk.