{"id":"CVE-2026-5795","aliases":["GHSA-r7p8-xq5m-436c"],"url":"https://o3.security/vulnerability/CVE-2026-5795","summary":"Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","details":"### Description (as reported)\n\nA security vulnerability has been identified in Jetty's  `JaspiAuthenticator.java`. \n\nThe root cause is a failure to consistently clear authentication metadata stored in  `ThreadLocal`  during certain error or incomplete authentication flows. \nSpecifically, after a `GroupPrincipalCallback`  is persisted into the  `ThreadLocal`, the authentication process may exit prematurely — before the  `ThreadLocal`  storage is cleared — if a mandatory `CallerPrincipalCallback`  is missing or an exception occurs. \nThis allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.\n\nSee also attached PDF.\n\n### Impact\nAn unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).\n\n### Patches\nNo patches yet.\n\n### Workarounds\nDo not use Jetty's JASPI.","published":"2026-04-08T13:32:28.935Z","modified":"2026-10-28T02:30:57.683130618Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","fixedVersion":"12.1.8"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","fixedVersion":"12.1.8"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","fixedVersion":"12.1.8"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","fixedVersion":"12.1.8"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","fixedVersion":"12.0.34"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","fixedVersion":"12.0.34"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","fixedVersion":"12.0.34"},{"ecosystem":"Maven","name":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","fixedVersion":"12.0.34"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-jaspi","fixedVersion":"11.0.29"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-jaspi","fixedVersion":"10.0.29"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-jaspi","fixedVersion":"9.4.61"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17668"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28573"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-5795"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5795.json"},{"type":"ADVISORY","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5795"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456519"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/92"},{"type":"PACKAGE","url":"https://github.com/jetty/jetty.project"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c"},{"type":"WEB","url":"https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:57.683130618Z"}}