CVE-2026-107281
Description
A flaw was found in AsyncHttpClient. When connection-oriented authentication mechanisms, such as NT LAN Manager (NTLM) or Negotiate, are used, the HTTP connection pool does not account for the authenticated user identity. Consequently, a connection authenticated by one user can be reused by requests from a different user, causing the remote server to process the subsequent request under the original user's identity. This flaw allows an attacker to gain unauthorized access and achieve privilege escalation by executing actions as another user.
Statement
A flaw of moderate impact was found in the AsyncHttpClient (AHC) library, which is used in Red Hat JBoss Fuse 7. When connection-oriented authentication mechanisms such as NTLM or Negotiate are used, the HTTP/1.1 connection pool does not include the authenticated user identity in its pool key. As a result, a pooled connection that was authenticated for one user can be reused for a request from a different user, and the remote server processes that request under the original user's identity. This allows an attacker who can issue their own authenticated requests through a shared client to gain unauthorized access to another user's data and to perform actions as that user, resulting in privilege escalation. Basic and Digest authentication are not affected because they authenticate each request individually. Although the upstream CVE record carries a CVSS v4 score of 7.6 (important), Red Hat rates this flaw as moderate because exploitation has high attack complexity: it requires connection-oriented NTLM or Negotiate authentication and depends on a pooled connection being reused across different principals. The affected Red Hat JBoss Fuse 7 stream (fuse-7-els-2) is out of support scope, so no fix is planned for it.
Mitigation
Workarounds documented by the upstream project include: using a separate AsyncHttpClient instance per authenticated principal when NTLM or Negotiate authentication is used; implementing a per-request ChannelPoolPartitioning that includes the authenticated principal in the connection pool key; or removing connection reuse by disabling connection pooling or setting the maximum connections per host to zero. Applications can also avoid the issue by using request-oriented authentication mechanisms such as Basic or Digest, which authenticate each request individually. Upgrading to an upstream release that includes the fix also addresses the issue. The affected Red Hat JBoss Fuse 7 stream is out of support scope, and no Red Hat update is currently planned for it.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
