CVE-2026-15075 is a vulnerability in Eclipse Vert.x's DefaultRedirectHandler component that affects versions up to and including 4.5.29 and 5.1.4. The handler forwards all HTTP request headers as-is during cross-origin HTTP 30x redirects without verifying the redirect target's origin (scheme, host, port). Only the Content-Length header is stripped. This behavior results in exposure of sensitive headers such as Authorization, Cookie, Proxy-Authorization, and custom headers like X-API-Token to potentially attacker-controlled redirect destinations. An attacker able to cause a Vert.x HttpClient to follow a redirect to a malicious host can capture bearer tokens, basic authentication credentials, session cookies, and API keys from the original request headers.

Sensitive authentication and session information can be leaked to unauthorized actors if an attacker can induce a redirect to a host they control. This can lead to credential theft including bearer tokens, basic auth credentials, session cookies, and API keys. The vulnerability does not require user interaction or privileges and can be triggered remotely via HTTP redirects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using Vert.x HttpClient to follow redirects to untrusted or attacker-controlled hosts. Implement manual validation of redirect targets or disable automatic redirect following if possible.