Incorrect authorization in Eclipse Jetty security constraints
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
Eclipse Jetty jetty-security is affected from 7.6.13 through 9.4.64, from 10.0.0 through 10.0.32 and from 11.0.0 through 11.0.32, and the jetty-ee8 and jetty-ee9 security modules and jetty-ee10 servlet module are affected from 12.0.0 through 12.0.38 and from 12.1.0 through 12.1.11, with jetty-ee11 servlet affected from 12.1.0 through 12.1.11. Two or more security constraints with the same http-method-omission set and no url-patterns are not combined as the Jakarta Servlet Specification requires (CWE-863). Later constraints override earlier ones with that set, so the earlier restrictions no longer apply. A remote attacker needs no privileges or user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | org.eclipse.jetty.ee11:jetty-ee11-servlet | 12.1.0 – 12.1.11 | — | No fix listed | CNA |
| Eclipse Foundation | org.eclipse.jetty.ee10:jetty-ee10-servlet | 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 | — | No fix listed | CNA |
| Eclipse Foundation | org.eclipse.jetty.ee9:jetty-ee9-security | 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 | — | No fix listed | CNA |
| Eclipse Foundation | org.eclipse.jetty.ee8:jetty-ee8-security | 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 | — | No fix listed | CNA |
| Eclipse Foundation | org.eclipse.jetty:jetty-security | 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 7.6.13 – 9.4.64 | — | No fix listed | CNA |
- org.eclipse.jetty.ee11:jetty-ee11-servlet VendorEclipse Foundation Affected 12.1.0 – 12.1.11 Fixed in — No fix listed CNA
- org.eclipse.jetty.ee10:jetty-ee10-servlet VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
- org.eclipse.jetty.ee9:jetty-ee9-security VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
- org.eclipse.jetty.ee8:jetty-ee8-security VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-security VendorEclipse Foundation Affected 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 7.6.13 – 9.4.64 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for jetty-security, jetty-ee8-security, jetty-ee9-security, jetty-ee10-servlet or jetty-ee11-servlet. Red Hat lists Red Hat Fuse 7 and OpenShift Developer Tools and Services as affected with no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Offline Knowledge Portal | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
Not affected: 5 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Satellite 6
Timeline
- 2026-10-16 Threatist record created from CVE-2026-18662
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
More Eclipse Foundation vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
- TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
- TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
- TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
- TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-18662 · CVE Program
- CVE-2026-18662 · NVD
- FIRST EPSS
- CVE-2026-18662 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences