CLEANSTART-2026-HR73179: In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials
Published Nov 14, 2026
·Updated
Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials.
Affected Software
1 affected componentFixes available
cleanstart/elasticsearch<9.2.8-r13
9.2.8-r13
Frequently Asked Questions
1
What conditions are required for exposure?
Exposure is limited to scenarios where a Reactor Netty WebSocket client follows a WebSocket handshake redirect to a different origin. The issue involves credentials being leaked during that redirect flow.
2
How can teams identify potentially affected activity?
Review WebSocket client behavior for handshake redirects that cross origins, particularly where credentials are supplied to the client. The provided information does not identify affected versions, default configurations, or a workaround.