CVE-2026-5795: High severity Eclipse Jetty vulnerability
Description (as reported)
A security vulnerability has been identified in Jetty's JaspiAuthenticator.java.
The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal during certain error or incomplete authentication flows. Specifically, after a GroupPrincipalCallback is persisted into the ThreadLocal, the authentication process may exit prematurely — before the ThreadLocal storage is cleared — if a mandatory CallerPrincipalCallback is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.
See also attached PDF.
Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).
Patches No patches yet.
Workarounds Do not use Jetty's JASPI.
Other sources
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10to a version that resolves this vulnerability.Fixed in 9.4.60 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10to a version that resolves this vulnerability.Fixed in 10.0.28 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10to a version that resolves this vulnerability.Fixed in 11.0.28 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10to a version that resolves this vulnerability.Fixed in 12.0.33 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10to a version that resolves this vulnerability.Fixed in 12.1.7 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-jaspito a version that resolves this vulnerability.Fixed in 9.4.61 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-jaspito a version that resolves this vulnerability.Fixed in 10.0.29 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-jaspito a version that resolves this vulnerability.Fixed in 11.0.29 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee8:jetty-ee8-jaspito a version that resolves this vulnerability.Fixed in 12.0.34 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee9:jetty-ee9-jaspito a version that resolves this vulnerability.Fixed in 12.0.34 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10-jaspito a version that resolves this vulnerability.Fixed in 12.0.34 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee11:jetty-ee11-jaspito a version that resolves this vulnerability.Fixed in 12.0.34 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee8:jetty-ee8-jaspito a version that resolves this vulnerability.Fixed in 12.1.8 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee9:jetty-ee9-jaspito a version that resolves this vulnerability.Fixed in 12.1.8 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee10:jetty-ee10-jaspito a version that resolves this vulnerability.Fixed in 12.1.8 - Upgrade
Upgrade
maven/org.eclipse.jetty.ee11:jetty-ee11-jaspito a version that resolves this vulnerability.Fixed in 12.1.8 - Configuration
Disable/avoid Jetty's JASPI integration so that the class JASPIAuthenticator is not used for authentication.
Jetty (JASPIAuthenticator) JASPI usage = Do not use Jetty's JASPI - Compensating control
Ensure requests are not processed by the same worker thread after an incomplete/failed JASPI authentication flow (e.g., isolate authentication handling to prevent ThreadLocal security metadata from being inherited by a subsequent request).