Skip to content
fr Sign in
7.4 High

CVE-2026-5795 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Description

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Affected products and versions

Product Affected versions Fixed in
Eclipse Jetty 12.1 12.1.0 → 12.1.7 No fix stated
Eclipse Jetty 12.0 12.0.0 → 12.0.33 No fix stated
Eclipse Jetty 11.0 11.0.0 → 11.0.28 No fix stated
Eclipse Jetty 10.0 10.0.0 → 10.0.28 No fix stated
Eclipse Jetty 9.4 9.4.0 → 9.4.60 No fix stated
HawtIO HawtIO 4.4.0 Versions not published
Red Hat Offline Knowledge Portal 1.2.6 Versions not published
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 Versions not published
streams for Apache Kafka 3 Versions not published
Show the 12 other branches
Product Affected versions Fixed in
Red Hat Data Grid 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Offline Knowledge Portal 1.2.7 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.3 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.4 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.5 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.10 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.9 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.12 1782239370 earliest → < 1782239370 1782239370
Red Hat Offline Knowledge Portal 1.2.2 1782239370 earliest → < 1782239370 1782239370

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse Jetty

The 16 CVEs of Eclipse Jetty →
CVE-2026-18661 In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec… 8.8 High CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy… 8.2 High CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to… 8.2 High CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such… 6.9 Medium
Track this CVE