Apache Neethi: Apache Neethi: Information disclosure and network access bypass via PolicyReference API

🗓️ 20 May 2026 20:47:38Reported by RedHatType

Apache Neethi PolicyReference interface allows unrestricted remote resources, risking information disclosure and internal network exposure.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact 7.1.1.0	1 Jul 202619:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Apache HttpClient and Apache Neethi ( CVE-2026-40542, CVE-2026-42402, CVE-2026-42403 & CVE-2026-42404 )	29 Jun 202608:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities due to Neethi (CVE-2026-42402, CVE-2026-42403, CVE-2026-42404)	23 Jun 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Log4j and Apache Neethi	8 Jun 202611:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	20 May 202620:13	–	ibm
ATTACKERKB	CVE-2026-42404	1 May 202609:46	–	attackerkb
Chainguard	CVE-2026-42404 vulnerabilities	12 May 202619:18	–	cgr
CNNVD	Apache Neethi 代码问题漏洞	1 May 202600:00	–	cnnvd
CVE	CVE-2026-42404	1 May 202609:46	–	cve
Cvelist	CVE-2026-42404 Apache Neethi: Unrestricted HTTP Redirect Following in Policy References	1 May 202609:46	–	cvelist

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42404
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/zdspnt64zznyjyn648553kptx69w23oq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42404
cve	www.cve.org/CVERecord

02 Jul 2026 15:34Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5 - 7.2

EPSS0.00497

SSVC