CVE-2026-118489
Last modified
CVE-2026-118489 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response.
Description
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | >= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-118489?
How severe is CVE-2026-118489?
How do I fix CVE-2026-118489?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-118475A flaw was found in Eye of GNOME. When parsing a specially c…3.6
- CVE-2026-118477The ei_git_repo_url parameter in the Git remote configuratio…9.8
- CVE-2026-11848The iRM-IEI Remote Management developed by IEI Integration C…5.3
- CVE-2026-118485Axel Download Accelerator 2.17.14 and earlier performs URL p…8.1
- CVE-2026-118487In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2]…7.5
- CVE-2026-118488In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2]…5.9
- CVE-2026-11849The iRM-IEI Remote Management developed by IEI Integration …9.8
- CVE-2026-118494Joomla Extension - jreviews.com - Secret configs cached in a…8.2
- CVE-2026-1185A configuration file on the local file system had improper i…8.8
- CVE-2026-11850An integer underflow vulnerability was found in MIT krb5 in …5
- CVE-2026-118500The Cool FormKit Lite – Advanced Form Builder for Elementor …6.4
- CVE-2026-118504The web interface blocks issue and pull request changes on a…
Are you affected by CVE-2026-118489?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST