Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2026-5795: Jetty JASPI authenticator may let users gain extra rights
CVE-2026-5795 · published 7 months ago
Summary
The Jetty web server component that handles JASPI authentication can leave internal data uncleared when a request ends early. This can cause later requests on the same processing thread to inherit the previous user's credentials, allowing unauthorized access or privilege escalation. Update Jetty to the latest version that includes the fix and restart the server to apply the patch.
What to do
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10 to version 12.1.7.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10 to version 12.0.33.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10 to version 11.0.28.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10 to version 10.0.28.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10 to version 9.4.60.
- Update eclipse org.eclipse.jetty:jetty-jaspi to version 11.0.29.
- Update eclipse org.eclipse.jetty:jetty-jaspi to version 10.0.29.
- Update eclipse org.eclipse.jetty:jetty-jaspi to version 9.4.61.
- Update eclipse org.eclipse.jetty.ee8:jetty-ee8-jaspi to version 12.1.8.
- Update eclipse org.eclipse.jetty.ee8:jetty-ee8-jaspi to version 12.0.34.
- Update eclipse org.eclipse.jetty.ee11:jetty-ee11-jaspi to version 12.1.8.
- Update eclipse org.eclipse.jetty.ee11:jetty-ee11-jaspi to version 12.0.34.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.1.8.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.34.
- Update eclipse org.eclipse.jetty.ee9:jetty-ee9-jaspi to version 12.1.8.
- Update eclipse org.eclipse.jetty.ee9:jetty-ee9-jaspi to version 12.0.34.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.13-root.io.6.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.4.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.5.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.6.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.7.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-aikido.7.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.16-root.io.3.
- Update org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-aikido.9.
- Update org.eclipse.jetty.ee11:jetty-ee11-jaspi to version 12.1.7-aikido.1.
- Update io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.9.
- Update io.root.org.eclipse.jetty.ee11:jetty-ee11-jaspi to version 12.1.7-root.io.1.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.8.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-aikido.8.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.13-aikido.10.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.13-root.io.10.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.16-root.io.5.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.16-aikido.5.
- Update root io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-root.io.9.
- Update eclipse org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.3-aikido.9.
- Update org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.33-aikido.3.
- Update io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi to version 12.0.33-root.io.3.
- Update debian jetty12 to version 12.0.39-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | eclipse | org.eclipse.jetty.ee10:jetty-ee10 |
>= 12.1.0, < 12.1.7 >= 12.0.0, < 12.0.33 >= 11.0.0, < 11.0.28 >= 10.0.0, < 10.0.28 >= 9.4.0, < 9.4.60 Fix: upgrade to 12.1.7
|
| Debian:13 | debian | jetty12 | All versions |
| Debian:14 | debian | jetty12 |
< 12.0.39-1 Fix: upgrade to 12.0.39-1
|
| Debian:11 | debian | jetty9 | All versions |
| Debian:12 | debian | jetty9 | All versions |
| maven | eclipse | org.eclipse.jetty:jetty-jaspi |
>= 11.0.0, <= 11.0.28 >= 10.0.0, <= 10.0.28 >= 9.4.0, <= 9.4.60 Fix: upgrade to 11.0.29
|
| maven | eclipse | org.eclipse.jetty.ee8:jetty-ee8-jaspi |
>= 12.1.0, <= 12.1.7 >= 12.0.0, <= 12.0.33 Fix: upgrade to 12.1.8
|
| maven | eclipse | org.eclipse.jetty.ee11:jetty-ee11-jaspi |
>= 12.1.0, <= 12.1.7 >= 12.0.0, <= 12.0.33 Fix: upgrade to 12.1.8
|
| maven | eclipse | org.eclipse.jetty.ee10:jetty-ee10-jaspi |
>= 12.1.0, <= 12.1.7 >= 12.0.0, <= 12.0.33 Fix: upgrade to 12.1.8
|
| maven | eclipse | org.eclipse.jetty.ee9:jetty-ee9-jaspi |
>= 12.1.0, <= 12.1.7 >= 12.0.0, <= 12.0.33 Fix: upgrade to 12.1.8
|
| Maven | eclipse | org.eclipse.jetty:jetty-jaspi |
>= 11.0.0, < 11.0.29 >= 10.0.0, < 10.0.29 >= 9.4.0, < 9.4.61 Fix: upgrade to 11.0.29
|
| Maven | eclipse | org.eclipse.jetty.ee8:jetty-ee8-jaspi |
>= 12.1.0, < 12.1.8 >= 12.0.0, < 12.0.34 Fix: upgrade to 12.1.8
|
| Maven | eclipse | org.eclipse.jetty.ee11:jetty-ee11-jaspi |
>= 12.1.0, < 12.1.8 >= 12.0.0, < 12.0.34 Fix: upgrade to 12.1.8
|
| Maven | eclipse | org.eclipse.jetty.ee10:jetty-ee10-jaspi |
>= 12.1.0, < 12.1.8 >= 12.0.0, < 12.0.34 Fix: upgrade to 12.1.8
|
| Maven | eclipse | org.eclipse.jetty.ee9:jetty-ee9-jaspi |
>= 12.1.0, < 12.1.8 >= 12.0.0, < 12.0.34 Fix: upgrade to 12.1.8
|
| – | eclipse | jetty |
>= 9.4.0, <= 9.4.58 >= 10.0.0, <= 10.0.26 >= 11.0.0, <= 11.0.26 >= 12.0.0, < 12.0.34 >= 12.1.0, < 12.1.8 cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* |
| Debian:13 | debian | jetty9 | All versions |
| Debian:14 | debian | jetty9 | All versions |
| Root:Maven | root | io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi |
< 12.0.13-root.io.6 < 12.0.3-root.io.4 < 12.0.3-root.io.5 < 12.0.3-root.io.6 < 12.0.3-root.io.7 < 12.0.16-root.io.3 < 12.0.3-root.io.8 < 12.0.13-root.io.10 < 12.0.16-root.io.5 < 12.0.3-root.io.9 Fix: upgrade to 12.0.13-root.io.6
|
| Root:Maven | eclipse | org.eclipse.jetty.ee10:jetty-ee10-jaspi |
< 12.0.3-aikido.7 < 12.0.3-aikido.8 < 12.0.13-aikido.10 < 12.0.16-aikido.5 < 12.0.3-aikido.9 Fix: upgrade to 12.0.3-aikido.7
|
| Root:Maven | – | org.eclipse.jetty.ee10:jetty-ee10-jaspi |
< 12.0.3-aikido.9 < 12.0.33-aikido.3 Fix: upgrade to 12.0.3-aikido.9
|
| Root:Maven | – | org.eclipse.jetty.ee11:jetty-ee11-jaspi |
< 12.1.7-aikido.1 Fix: upgrade to 12.1.7-aikido.1
|
| Root:Maven | – | io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi |
< 12.0.3-root.io.9 < 12.0.33-root.io.3 Fix: upgrade to 12.0.3-root.io.9
|
| Root:Maven | – | io.root.org.eclipse.jetty.ee11:jetty-ee11-jaspi |
< 12.1.7-root.io.1 Fix: upgrade to 12.1.7-root.io.1
|
| – | eclipse foundation | eclipse jetty | <= 12.1.7 |
| Ubuntu:14.04:LTS | canonical | jetty | All versions |
| Ubuntu:16.04:LTS | canonical | jetty9 | All versions |
Original advisory text
CVE-2026-5795 in org.eclipse.jetty.ee10:jetty-ee10-jaspi - Patched by Root
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://github.com/advisories/GHSA-gc59-r5jq-98qw
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_R...
- https://github.com/advisories/GHSA-r7p8-xq5m-436c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5795.j... Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:17668 Vendor Advisory
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436cht... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:28573 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5795 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456519 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json URL
- https://access.redhat.com/errata/RHSA-2026:25089 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-5795 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-5795 Third Party Advisory
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92 Third Party Advisory
- https://github.com/jetty/jetty.project Product
- https://security-tracker.debian.org/tracker/CVE-2026-5795 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-226Sensitive Information in Resource Not Removed Before Reuse
CWE-287Improper Authentication
Timeline
Published8 Apr 2026
Updated4 Nov 2026
First seen8 Apr 2026
Sources
DEBIAN-CVE-2026-5795 · OSV
CVE-2026-5795 · NVD
GHSA-gc59-r5jq-98qw · GHSA
GHSA-r7p8-xq5m-436c · GHSA
GHSA-gc59-r5jq-98qw · OSV
CVE-2026-5795 · MITRE
CVE-2026-5795 · OSV
UBUNTU-CVE-2026-5795 · OSV
Track software like this
Free during beta