CVE-2026-5795: eclipse foundation eclipse jetty
Vulnerability summary
CVE-2026-5795 is a high (CVSS 7.4) vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 08-04-2026PublishedVulnerability first disclosed.
- 14-09-2026Last modifiedVulnerability information updated.
Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.08 pp
From 0.53% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-226Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Debian2 products
- jetty12All versions (No fix recorded)
- jetty9All versions (No fix recorded)
Ubuntu2 products
- jettyAll versions (No fix recorded)
- jetty9All versions (No fix recorded)
Eclipse1 product
- jetty≥ 9.4.0, ≤ 9.4.58 | ≥ 10.0.0, ≤ 10.0.26 | ≥ 11.0.0, ≤ 11.0.26 | ≥ 12.0.0, < 12.0.34 | ≥ 12.1.0, < 12.1.8
Eclipse foundation1 product
- eclipse jetty≥ 12.1.0, ≤ 12.1.7 | ≥ 12.0.0, ≤ 12.0.33 | ≥ 11.0.0, ≤ 11.0.28 | ≥ 10.0.0, ≤ 10.0.28 | ≥ 9.4.0, ≤ 9.4.60
Org.eclipse.jetty1 product
- jetty-jaspi≥ 11.0.0, < 11.0.29 | ≥ 10.0.0, < 10.0.29 | ≥ 9.4.0, < 9.4.61
Org.eclipse.jetty.ee101 product
- jetty-ee10-jaspi≥ 12.1.0, < 12.1.8 | ≥ 12.0.0, < 12.0.34
Org.eclipse.jetty.ee111 product
- jetty-ee11-jaspi≥ 12.1.0, < 12.1.8 | ≥ 12.0.0, < 12.0.34
Org.eclipse.jetty.ee81 product
- jetty-ee8-jaspi≥ 12.1.0, < 12.1.8 | ≥ 12.0.0, < 12.0.34
Org.eclipse.jetty.ee91 product
- jetty-ee9-jaspi≥ 12.1.0, < 12.1.8 | ≥ 12.0.0, < 12.0.34
9 vendors · 11 products
