Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-5795

Eclipse Jetty · Vulnerability

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-5795

Published

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-5795

Published

Eclipse Jetty

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Eclipse Foundation",
                    "product": "Eclipse Jetty",
                    "repo": "https://github.com/jetty/jetty.project",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "12.1.0",
                            "lessThanOrEqual": "12.1.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "12.0.0",
                            "lessThanOrEqual": "12.0.33",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "11.0.0",
                            "lessThanOrEqual": "11.0.28",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "10.0.0",
                            "lessThanOrEqual": "10.0.28",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "9.4.0",
                            "lessThanOrEqual": "9.4.60",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON