The vulnerability CVE-2026-41715 in Spring Reactor Netty involves the potential leakage of credentials when the HTTP client follows redirects from a secure HTTPS endpoint to an insecure HTTP endpoint. This occurs only if the client is explicitly configured to follow redirects. Affected versions include Reactor Netty 1.0.0 through 1.0.51, 1.1.0 through 1.1.35, 1.2.0 through 1.2.17, and 1.3.0 through 1.3.5. The issue is categorized as CWE-522, indicating insufficiently protected credentials. The CVSS v3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. There is no vendor advisory or patch information available at this time.

If exploited, this vulnerability could lead to the leakage of sensitive credentials when an HTTP client follows redirects from HTTPS to HTTP, potentially exposing credentials to interception on insecure channels. The impact is limited to confidentiality and integrity with no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring Reactor Netty HTTP clients to follow redirects from secure to insecure endpoints, or implement additional controls to prevent credential leakage during such redirects.