Eclipse Jetty EUVD-2026-101947

Exploitation requires that the victim application uses Jetty's HttpClient configured to route requests through a forward proxy with proxy authentication credentials set, and that the attacker controls or can impersonate the destination server so it can return an HTTP 407 (Proxy Authentication Required) response. The flaw is a client-side misattribution: the client treats a server-origin 407 as a proxy challenge and resends with the Proxy-Authentication header. Limiting factors: it only applies when a proxy with credentials is in use (reflected by AT:P), the attacker must occupy the destination-server position in the connection, and only proxy credentials are exposed - there is no impact against deployments that do not use an authenticated forward proxy.

The input provides a CVSS 4.0 vector (8.2, High) with AV:N/AC:L/AT:P/PR:N/UI:N and a pure confidentiality impact (VC:H, VI:N, VA:N), consistent with CWE-200 information disclosure. The network vector and lack of required privileges/user interaction look alarming, but the AT:P (attack requirements present) metric is the key moderating signal: exploitation is not opportunistic - it depends on the victim deploying Jetty's HttpClient behind a forward proxy with configured proxy credentials AND the attacker controlling (or impersonating) the destination server that returns a 407. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so this is no public exploit identified at time of analysis - not active exploitation. The only impact is disclosure of proxy credentials to a malicious upstream server; there is no integrity or availability impact and no code execution. Net: this is a genuine credential-leakage flaw worth patching, but it is a conditional, confidentiality-only issue rather than a drop-everything mass-exploitation threat; the high CVSS is driven by the sensitivity of leaked credentials, not by ease or breadth of exploitation.

An application using Jetty's HttpClient routes outbound requests through a forward proxy that requires authentication. An attacker who controls or impersonates the destination server responds with HTTP 407 (Proxy Authentication Required); the client misattributes this to the proxy and resends the request including the Proxy-Authentication header, handing the proxy credentials directly to the attacker-controlled server. No public proof-of-concept is referenced in the input, and the attacker must be positioned as the destination endpoint.