CVE-2026-5795

org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables

View on CVE.org
Published Apr 8, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.


Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.


A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Analysis

AI-generated

Technical impact

The flaw occurs in Eclipse Jetty’s JASPIAuthenticator class, where thread-local variables used for authentication checks are not cleared when an early return happens. As a result, a subsequent request handled by the same thread inherits stale authentication data, effectively bypassing access controls and allowing an attacker to execute actions with elevated privileges. This represents an authentication bypass and broken access control weakness.

Affected Systems

Any installation of the Eclipse Jetty web server that includes the JASPIAuthenticator component is potentially vulnerable. Specific product and version details are not listed in the advisory, so all supported Jetty releases should be verified for the presence of the issue.

Risk and Exploitability

The advisory assigns a CVSS base score of 7.4, indicating a high impact vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as remote, relying on HTTP requests sent to the server; an attacker must be able to send multiple requests that are processed on the same worker thread to exploit the thread‑local residue.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Eclipse Jetty update that resolves the JASPIAuthenticator thread‑local clearance bug.
  • If a patch is not yet available, upgrade to a Jetty version that does not include the vulnerable JASPIAuthenticator implementation.
  • Implement monitoring to detect unexpected privilege escalation events and review server logs for anomalous access patterns.
  • Consider configuring the server to use a dedicated thread pool that limits the reuse of worker threads for sequential requests.

Generated by OpenCVE AI on April 8, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-gc59-r5jq-98qw Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Github GHSA Github GHSA GHSA-r7p8-xq5m-436c Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
History
Type Values Removed Values Added
CPEs cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title ThreadLocal Variable Leak Allows Thread-Based Privilege Escalation in Eclipse Jetty JASPIAuthenticator org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Title ThreadLocal Variable Leak Allows Thread-Based Privilege Escalation in Eclipse Jetty JASPIAuthenticator
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse jetty
Vendors & Products Eclipse
Eclipse jetty
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Weaknesses CWE-226
CWE-287
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Earlier changes (1)
Weaknesses
  • CWE-226

    Sensitive Information in Resource Not Removed Before Reuse

  • CWE-287

    Improper Authentication

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Sep 14, 2026, 12:04 PM
Reserved
Apr 8, 2026, 1:21 PM

View source JSON

Updated
Sep 14, 2026, 12:04 PM

JSON

Status
Modified
Published
Apr 8, 2026, 2:16 PM
Modified
Sep 14, 2026, 1:18 PM

View source JSON

Severity
Important
Public date
Apr 8, 2026, 1:32 PM

View source Bugzilla JSON

Updated
Apr 8, 2026, 7:39 PM

JSON