CVE-2026-5795

Severity CVSS v4.0:

Pending analysis

Type:

CWE-226 Sensitive Information in Resource Not Removed Before Reuse

Publication date:

08/04/2026

Last modified:

23/04/2026

Description

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 7.40 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): None

Base Score 3.x

7.40

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:eclipse:jetty::::::::	9.4.0 (including)	9.4.58 (including)
cpe:2.3:a:eclipse:jetty::::::::	10.0.0 (including)	10.0.26 (including)
cpe:2.3:a:eclipse:jetty::::::::	11.0.0 (including)	11.0.26 (including)
cpe:2.3:a:eclipse:jetty::::::::	12.0.0 (including)	12.0.34 (excluding)
cpe:2.3:a:eclipse:jetty::::::::	12.1.0 (including)	12.1.8 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-5795

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools