CVE-2026-5795

High

Description

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

SeverityHigh

CVSS7.4

Exploit probability—

Product

Eclipse Jetty

PublishedApr 8, 2026

First seenApr 8, 2026

Weakness typeCWE-226CWE-226 CWE-287Improper authentication

How to fix

Update

eclipse jetty12.0.34, 12.1.8 or later
org.eclipse.jetty.ee11:jetty-ee11-jaspi12.1.8, 12.0.34 or later
org.eclipse.jetty.ee10:jetty-ee10-jaspi12.1.8, 12.0.34 or later
org.eclipse.jetty.ee9:jetty-ee9-jaspi12.1.8, 12.0.34 or later
org.eclipse.jetty.ee8:jetty-ee8-jaspi12.1.8, 12.0.34 or later
org.eclipse.jetty:jetty-jaspi11.0.29, 10.0.29, 9.4.61 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
eclipse jetty	9.4.0 ≤ v ≤ 9.4.58, 10.0.0 ≤ v ≤ 10.0.26, 11.0.0 ≤ v ≤ 11.0.26, 12.0.0 ≤ v < 12.0.34, 12.1.0 ≤ v < 12.1.8	12.0.34, 12.1.8
org.eclipse.jetty.ee11:jetty-ee11-jaspiMaven	12.1.0 ≤ v < 12.1.8, 12.0.0 ≤ v < 12.0.34	12.1.8, 12.0.34
org.eclipse.jetty.ee10:jetty-ee10-jaspiMaven	12.1.0 ≤ v < 12.1.8, 12.0.0 ≤ v < 12.0.34	12.1.8, 12.0.34
org.eclipse.jetty.ee9:jetty-ee9-jaspiMaven	12.1.0 ≤ v < 12.1.8, 12.0.0 ≤ v < 12.0.34	12.1.8, 12.0.34
org.eclipse.jetty.ee8:jetty-ee8-jaspiMaven	12.1.0 ≤ v < 12.1.8, 12.0.0 ≤ v < 12.0.34	12.1.8, 12.0.34
org.eclipse.jetty:jetty-jaspiMaven	11.0.0 ≤ v < 11.0.29, 10.0.0 ≤ v < 10.0.29, 9.4.0 ≤ v < 9.4.61	11.0.29, 10.0.29, 9.4.61

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.