Log in Start free

Vulnerability · Published Apr 8, 2026 · Assigned by eclipse

CVE-2026-5795

High 7.4

In plain English

A high-severity improper authentication in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jetty12no fix listedDEBIAN-CVE-2026-5795
Debian:14jetty1212.0.39-1DEBIAN-CVE-2026-5795
Debian:12jetty9no fix listedDEBIAN-CVE-2026-5795
Debian:13jetty9no fix listedDEBIAN-CVE-2026-5795
Debian:14jetty9no fix listedDEBIAN-CVE-2026-5795
Mavenorg.eclipse.jetty.ee10:jetty-ee10-jaspi12.0.34GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee10:jetty-ee10-jaspi12.1.8GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee11:jetty-ee11-jaspi12.0.34GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee11:jetty-ee11-jaspi12.1.8GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee8:jetty-ee8-jaspi12.1.8GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee8:jetty-ee8-jaspi12.0.34GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee9:jetty-ee9-jaspi12.1.8GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty.ee9:jetty-ee9-jaspi12.0.34GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty:jetty-jaspi10.0.29GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty:jetty-jaspi11.0.29GHSA-r7p8-xq5m-436c
Mavenorg.eclipse.jetty:jetty-jaspi9.4.61GHSA-r7p8-xq5m-436c
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2026-5795
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2026-5795
Ubuntu:25.10jetty9no fix listedUBUNTU-CVE-2026-5795
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2026-5795
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2026-5795

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 12.1.0 – through 12.1.712.0.0 – through 12.0.3311.0.0 – through 11.0.2810.0.0 – through 10.0.289.4.0 – through 9.4.60

Weakness: CWE-226, CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References