Read the docs
TI-2026-05076 Aliases CVE-2026-5795GHSA-r7p8-xq5m-436c

Improper authentication in Eclipse Jetty

Priority LOW 35CWE-226Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven): 12.1.8, 12.0.34org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven): 12.1.8, 12.0.34+3 more productsRed Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.7; 12.0.0 – 12.0.33; 11.0.0 – 11.0.28; 10.0.0 – 10.0.28; 9.4.0 – 9.4.60—No fix listedCNA
—org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven)12.1.0 to before 12.1.812.1.8Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven)12.1.0 to before 12.1.812.1.8Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven)12.1.0 to before 12.1.812.1.8Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven)12.1.0 to before 12.1.812.1.8Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven)12.0.0 to before 12.0.3412.0.34Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven)12.0.0 to before 12.0.3412.0.34Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven)12.0.0 to before 12.0.3412.0.34Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven)12.0.0 to before 12.0.3412.0.34Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty:jetty-jaspi (Maven)11.0.0 to before 11.0.2911.0.29Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty:jetty-jaspi (Maven)10.0.0 to before 10.0.2910.0.29Patch availableGHSA-r7p8-xq5m-436c
—org.eclipse.jetty:jetty-jaspi (Maven)9.4.0 to before 9.4.619.4.61Patch availableGHSA-r7p8-xq5m-436c
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.7; 12.0.0 – 12.0.33; 11.0.0 – 11.0.28; 10.0.0 – 10.0.28; 9.4.0 – 9.4.60 Fixed in — No fix listed CNA
  • org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) Vendor— Affected 12.1.0 to before 12.1.8 Fixed in 12.1.8 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) Vendor— Affected 12.1.0 to before 12.1.8 Fixed in 12.1.8 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven) Vendor— Affected 12.1.0 to before 12.1.8 Fixed in 12.1.8 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven) Vendor— Affected 12.1.0 to before 12.1.8 Fixed in 12.1.8 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) Vendor— Affected 12.0.0 to before 12.0.34 Fixed in 12.0.34 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) Vendor— Affected 12.0.0 to before 12.0.34 Fixed in 12.0.34 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven) Vendor— Affected 12.0.0 to before 12.0.34 Fixed in 12.0.34 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven) Vendor— Affected 12.0.0 to before 12.0.34 Fixed in 12.0.34 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty:jetty-jaspi (Maven) Vendor— Affected 11.0.0 to before 11.0.29 Fixed in 11.0.29 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty:jetty-jaspi (Maven) Vendor— Affected 10.0.0 to before 10.0.29 Fixed in 10.0.29 Patch available GHSA-r7p8-xq5m-436c
  • org.eclipse.jetty:jetty-jaspi (Maven) Vendor— Affected 9.4.0 to before 9.4.61 Fixed in 9.4.61 Patch available GHSA-r7p8-xq5m-436c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.0 – 9.4.58; 10.0.0 – 10.0.26; 11.0.0 – 11.0.26; 12.0.0 to before 12.0.34; 12.1.0 to before 12.1.8VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 – 9.4.58; 10.0.0 – 10.0.26; 11.0.0 – 11.0.26; 12.0.0 to before 12.0.34; 12.1.0 to before 12.1.8 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) Fixed in 12.1.8 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) Fixed in 12.1.8 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven) Fixed in 12.1.8 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven) Fixed in 12.1.8 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) Fixed in 12.0.34 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) Fixed in 12.0.34 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven) Fixed in 12.0.34 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven) Fixed in 12.0.34 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty:jetty-jaspi (Maven) Fixed in 11.0.29 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty:jetty-jaspi (Maven) Fixed in 10.0.29 Advisory →
  • Fix · GHSA-r7p8-xq5m-436c org.eclipse.jetty:jetty-jaspi (Maven) Fixed in 9.4.61 Advisory →

Red Hat 3 advisories

  • RHSA-2026:28573 Released 2026-06-23 · Red Hat rating Important
    Red Hat Offline Knowledge Portal security and content update
    • Red Hat Offline Knowledge Portal 1.2.13 registry.redhat.io/offline-knowledge-portal/rhokp-rhel9
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
Red Hat Offline Knowledge Portal 1.2.13Fixed RHSA-2026:28573
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Not affected: 5 products
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5795
  2. 2026-10-03 Alias added: GHSA-r7p8-xq5m-436c

References

Advisory 1

Other 5

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences