CVE-2026-5795 — Vulnerability in...
HIGH
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Published April 14, 2026Updated April 14, 2026Source: osv
Summary
### Description (as reported)
A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`.
The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows.
Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs.
This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.
See also attached PDF.
### Impact
An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).
### Patches
No patches yet.
### Workarounds
Do not use Jetty's JASPI.
Advisory Timeline
- First published April 14, 2026 (181 days ago).
- Last revised April 14, 2026 — 0 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.eclipse.jetty.ee10:jetty-ee10-jaspi to 12.0.34 or later<!-- Update pom.xml dependency version to 12.0.34 for org.eclipse.jetty.ee10:jetty-ee10-jaspi -->
Maven
Update org.eclipse.jetty.ee11:jetty-ee11-jaspi to 12.0.34 or later<!-- Update pom.xml dependency version to 12.0.34 for org.eclipse.jetty.ee11:jetty-ee11-jaspi -->
Maven
Update org.eclipse.jetty.ee9:jetty-ee9-jaspi to 12.1.8 or later<!-- Update pom.xml dependency version to 12.1.8 for org.eclipse.jetty.ee9:jetty-ee9-jaspi -->
Maven
Update org.eclipse.jetty:jetty-jaspi to 9.4.61 or later<!-- Update pom.xml dependency version to 9.4.61 for org.eclipse.jetty:jetty-jaspi -->
Maven
Update org.eclipse.jetty.ee10:jetty-ee10-jaspi to 12.1.8 or later<!-- Update pom.xml dependency version to 12.1.8 for org.eclipse.jetty.ee10:jetty-ee10-jaspi -->
Maven
Update org.eclipse.jetty.ee9:jetty-ee9-jaspi to 12.0.34 or later<!-- Update pom.xml dependency version to 12.0.34 for org.eclipse.jetty.ee9:jetty-ee9-jaspi -->
Maven
Update org.eclipse.jetty.ee11:jetty-ee11-jaspi to 12.1.8 or later<!-- Update pom.xml dependency version to 12.1.8 for org.eclipse.jetty.ee11:jetty-ee11-jaspi -->
Maven
Update org.eclipse.jetty:jetty-jaspi to 10.0.29 or later<!-- Update pom.xml dependency version to 10.0.29 for org.eclipse.jetty:jetty-jaspi -->
Maven
Update org.eclipse.jetty.ee8:jetty-ee8-jaspi to 12.0.34 or later<!-- Update pom.xml dependency version to 12.0.34 for org.eclipse.jetty.ee8:jetty-ee8-jaspi -->
Maven
Update org.eclipse.jetty:jetty-jaspi to 11.0.29 or later<!-- Update pom.xml dependency version to 11.0.29 for org.eclipse.jetty:jetty-jaspi -->
Maven
Update org.eclipse.jetty.ee8:jetty-ee8-jaspi to 12.1.8 or later<!-- Update pom.xml dependency version to 12.1.8 for org.eclipse.jetty.ee8:jetty-ee8-jaspi -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (11)
Affects 1 ecosystem: maven (5).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.eclipse.jetty.ee10:jetty-ee10-jaspi | maven | 12.0.0, 12.0.1, 12.0.10, 12.0.11 (+30 more) | 12.0.34 |
| org.eclipse.jetty.ee11:jetty-ee11-jaspi | maven | All versions | 12.0.34 |
| org.eclipse.jetty.ee9:jetty-ee9-jaspi | maven | 12.1.0, 12.1.1, 12.1.2, 12.1.3 (+4 more) | 12.1.8 |
| org.eclipse.jetty:jetty-jaspi | maven | 9.4.0.v20161208, 9.4.0.v20180619, 9.4.1.v20170120, 9.4.1.v20180619 (+70 more) | 9.4.61 |
| org.eclipse.jetty.ee10:jetty-ee10-jaspi | maven | 12.1.0, 12.1.1, 12.1.2, 12.1.3 (+4 more) | 12.1.8 |
| org.eclipse.jetty.ee9:jetty-ee9-jaspi | maven | 12.0.0, 12.0.1, 12.0.10, 12.0.11 (+30 more) | 12.0.34 |
| org.eclipse.jetty.ee11:jetty-ee11-jaspi | maven | 12.1.0, 12.1.1, 12.1.2, 12.1.3 (+4 more) | 12.1.8 |
| org.eclipse.jetty:jetty-jaspi | maven | 10.0.0, 10.0.1, 10.0.10, 10.0.11 (+23 more) | 10.0.29 |
| org.eclipse.jetty.ee8:jetty-ee8-jaspi | maven | 12.0.10, 12.0.11, 12.0.12, 12.0.13 (+28 more) | 12.0.34 |
| org.eclipse.jetty:jetty-jaspi | maven | 11.0.0, 11.0.1, 11.0.10, 11.0.11 (+23 more) | 11.0.29 |
| org.eclipse.jetty.ee8:jetty-ee8-jaspi | maven | 12.1.0, 12.1.1, 12.1.2, 12.1.3 (+4 more) | 12.1.8 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-226
- CWE-287Improper AuthenticationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.4 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436cWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795ADVISORY
- https://github.com/jetty/jetty.projectPACKAGE
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdfWEB
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92WEB
Frequently Asked Questions
- What is CVE-2026-5795?
- Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.4/10).
- How do I check if my project is affected by CVE-2026-5795?
- CVE-2026-5795 affects org.eclipse.jetty.ee10:jetty-ee10-jaspi, org.eclipse.jetty.ee11:jetty-ee11-jaspi and org.eclipse.jetty.ee9:jetty-ee9-jaspi (and 2 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-5795 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.4
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-r7p8-xq5m-436c
Related CVEs
- CVE-2026-10050HIGH
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
- CVE-2026-61570HIGH
MPXJ: XXE Vulnerability in MerlinReader
- CVE-2026-107725HIGH
Hazelcast has an authorization bypass in IMap Predicates API
- CVE-2023-44487MEDIUM
HTTP/2 Stream Cancellation Attack
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies