PT-2026-31308 · Eclipse · Eclipse Jetty

Published 2026-04-08 · Updated 2026-04-18 · CVE-2026-5795

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description Eclipse Jetty's JASPIAuthenticator class sets two ThreadLocal variables during authentication checks. Under certain conditions, the code returns early without clearing these ThreadLocal variables. A subsequent request using the same thread inherits these values, resulting in broken access control and potential privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Authentication

Weakness Enumeration

CWE-226

CWE-287

Related Identifiers

CVE-2026-5795

GHSA-GC59-R5JQ-98QW

GHSA-R7P8-XQ5M-436C

OPENSUSE-SU-2026:10574-1

Affected Products

Eclipse Jetty

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-5795 · Security Note
• https://ubuntu.com/security/CVE-2026-5795 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10574-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5795 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc59-r5jq-98qw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5795 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5795 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5795 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7p8-xq5m-436c · Vendor Advisory
• https://github.com/jetty/jetty.project · Note
• https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c · Note
• ❌ https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf · Note, Deleted
• https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps: · Note
• https://twitter.com/CVEnew/status/2043295653699244506 · Twitter Post
• https://suse.com/security/cve/CVE-2026-2332 · Note