NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

CVE-2026-5795 — jetty-ee11-jaspi

HIGH

CVE-2026-5795 is a high-severity (CVSS 7.4) CWE-226 vulnerability in org.eclipse.jetty.ee11:jetty-ee11-jaspi. A fix is available for org.eclipse.jetty.ee11:jetty-ee11-jaspi — see the affected versions and patch details below.

Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

Also known asGHSA-r7p8-xq5m-436c
Published
Updated
Affected
11 pkgs
Patched
11 / 11
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-5795.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk
0.00%0.37%0.74%1.11%0.0%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

11 pkgs affected
☕org.eclipse.jetty.ee11:jetty-ee11-jaspi☕org.eclipse.jetty.ee10:jetty-ee10-jaspi☕org.eclipse.jetty.ee9:jetty-ee9-jaspi☕org.eclipse.jetty.ee8:jetty-ee8-jaspi☕org.eclipse.jetty.ee11:jetty-ee11-jaspi☕org.eclipse.jetty.ee10:jetty-ee10-jaspi☕org.eclipse.jetty.ee9:jetty-ee9-jaspi☕org.eclipse.jetty.ee8:jetty-ee8-jaspi+3 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Description (as reported)

A security vulnerability has been identified in Jetty's JaspiAuthenticator.java.

The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal during certain error or incomplete authentication flows. Specifically, after a GroupPrincipalCallback is persisted into the ThreadLocal, the authentication process may exit prematurely — before the ThreadLocal storage is cleared — if a mandatory CallerPrincipalCallback is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.

See also attached PDF.

Impact

An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).

Patches

No patches yet.

Workarounds

Do not use Jetty's JASPI.

Affected Packages

11 total 11 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.eclipse.jetty.ee11:jetty-ee11-jaspi≥ 12.1.0&&< 12.1.812.1.8org.eclipse.jetty.ee11:jetty-ee11-jaspi:12.1.8
☕Mavenorg.eclipse.jetty.ee10:jetty-ee10-jaspi≥ 12.1.0&&< 12.1.812.1.8org.eclipse.jetty.ee10:jetty-ee10-jaspi:12.1.8
☕Mavenorg.eclipse.jetty.ee9:jetty-ee9-jaspi≥ 12.1.0&&< 12.1.812.1.8org.eclipse.jetty.ee9:jetty-ee9-jaspi:12.1.8
☕Mavenorg.eclipse.jetty.ee8:jetty-ee8-jaspi≥ 12.1.0&&< 12.1.812.1.8org.eclipse.jetty.ee8:jetty-ee8-jaspi:12.1.8
☕Mavenorg.eclipse.jetty.ee11:jetty-ee11-jaspi≥ 12.0.0&&< 12.0.3412.0.34org.eclipse.jetty.ee11:jetty-ee11-jaspi:12.0.34
☕Mavenorg.eclipse.jetty.ee10:jetty-ee10-jaspi≥ 12.0.0&&< 12.0.3412.0.34org.eclipse.jetty.ee10:jetty-ee10-jaspi:12.0.34

Affected Products

1 product · 5 configurations
Application
jettyeclipse
≥ 12.1.0 && ≤ 11.0.26
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.eclipse.jetty.ee11:jetty-ee11-jaspi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.eclipse.jetty.ee11:jetty-ee11-jaspi to 12.1.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-5795 is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This vulnerability is only exploitable when `JASPIAuthenticator` class returns early and a subsequent request inherits the un-cleared ThreadLocal values. This requires a new request to be assigned the exact same recycled thread, increasing the complexity of exploitation. Due to these reasons, this flaw has been rated…

Workaround published by Red Hat
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Source: Red Hat security advisory for CVE-2026-5795 (CC BY 4.0)
ProductFixed inAdvisory
HawtIO HawtIO 4.4.0jetty-ee10-servletRHSA-2026:25089
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14jetty-ee10-annotationsRHSA-2026:17668
Red Hat Offline Knowledge Portal 1.2.13offline-knowledge-portal/rhokp-rhel9:1782239370RHSA-2026:28573

Frequently Asked Questions

### Description (as reported) A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`. The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the sa
O3 Security · Impact-Aware SCA

Is CVE-2026-5795 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-5795: jetty-ee11-jaspi PrivEsc — Fixed in 12.1.8