High 7.4Published Apr 8, 2026

CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.

Updated under an hour ago (Oct 26, 2026, 8:30 PM ET)

Does this affect you?

It affects Eclipse Foundation Eclipse Jetty and 9 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Eclipse Foundation Eclipse Jetty

Exploited in the last 30 days

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-226, CWE-287
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: eclipse
NVD analysis: Modified
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Eclipse Foundation Eclipse Jetty eclipse_foundation:eclipse_jetty (from the name)	from 12.1.0 through 12.1.7; from 12.0.0 through 12.0.33; from 11.0.0 through 11.0.28; from 10.0.0 through 10.0.28; from 9.4.0 through 9.4.60	CNA record
Red Hat HawtIO HawtIO 4.4.0 redhat:apache_camel_hawtio	from ee10-servlet not affected; from ee10-webapp not affected	CISA ADP
Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 redhat:apache_camel_spring_boot	from ee10-annotations not affected; from ee10-plus not affected; from ee10-servlet not affected; from ee10-servlets not affected; from ee10-webapp not affected	CISA ADP
Red Hat Red Hat Offline Knowledge Portal 1.2.12 redhat:offline_knowledge_portal	from 1782239370 not affected	CISA ADP
Red Hat Red Hat Data Grid 8 redhat:jboss_data_grid	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8 redhat:jboss_enterprise_application_platform	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
Red Hat Red Hat OpenShift Dev Spaces redhat:openshift_devspaces	3	CISA ADP
Red Hat streams for Apache Kafka 3 redhat:amq_streams	3	CISA ADP
eclipse jetty eclipse:jetty	from 9.4.0 through 9.4.58; from 10.0.0 through 10.0.26; from 11.0.0 through 11.0.26; from 12.0.0 before 12.0.34; from 12.1.0 before 12.1.8	NVD

References

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://	broken-link
https://gitlab.eclipse.org/security/cve-assignment/-/issues/92	broken-link
https://access.redhat.com/errata/RHSA-2026:17668
https://access.redhat.com/errata/RHSA-2026:25089
https://access.redhat.com/errata/RHSA-2026:28573
https://access.redhat.com/security/cve/CVE-2026-5795
https://bugzilla.redhat.com/show_bug.cgi?id=2456519
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.