Is CVE-2026-5795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5795 being exploited in the wild.

How severe is CVE-2026-5795?

High severity, with a CVSS score of 7.4, published 8 April 2026.

Which products and versions are affected?

Eclipse Foundation Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7; org.eclipse.jetty:jetty-jaspi (Maven) ECOSYSTEM:introduced=11.0.0,fixed=11.0.29; org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.8; org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.8; and 2 more.

Is there a fix for CVE-2026-5795?

Yes. org.eclipse.jetty:jetty-jaspi (Maven): upgrade to 11.0.29 or later; org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven): upgrade to 12.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5795 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5795?

Check whether you run Eclipse Foundation Jetty, Eclipse Foundation Jetty EE10 JASPI, Eclipse Foundation Jetty EE11 JASPI or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5795: Eclipse Jetty privilege escalation in JASPIAuthenticator via ThreadLocal reuse

CVE-2026-5795 · Severity: high · CVSS 7.4 · Published 2026-04-08

Eclipse Jetty, a widely used web server and servlet engine, contains a security flaw in its authentication component. Under specific conditions, the server fails to clear security credentials from a processing thread after a request is finished. This allows a subsequent user's request, if handled by the same thread, to inherit the previous user's identity and permissions, potentially leading to unauthorized access to sensitive data or administrative functions.

Technologies: Eclipse Foundation Jetty, Red Hat build of Apache Camel for Spring Boot, Red Hat Streams for Apache Kafka. Vendors: Eclipse Foundation, Maven, Red Hat.

Quick answers

Is CVE-2026-5795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5795 being exploited in the wild.
How severe is CVE-2026-5795?: High severity, with a CVSS score of 7.4, published 8 April 2026.
Which products and versions are affected?: Eclipse Foundation Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7; org.eclipse.jetty:jetty-jaspi (Maven) ECOSYSTEM:introduced=11.0.0,fixed=11.0.29; org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.8; org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.8; and 2 more.
Is there a fix for CVE-2026-5795?: Yes. org.eclipse.jetty:jetty-jaspi (Maven): upgrade to 11.0.29 or later; org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven): upgrade to 12.1.8 or later; org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven): upgrade to 12.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5795 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5795?: Check whether you run Eclipse Foundation Jetty, Eclipse Foundation Jetty EE10 JASPI, Eclipse Foundation Jetty EE11 JASPI or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.eclipse.jetty:jetty-jaspi (Maven): upgrade to 11.0.29 or later

# set org.eclipse.jetty:jetty-jaspi to 11.0.29 in your pom.xml or build.gradle

org.eclipse.jetty.ee10:jetty-ee10-jaspi (Maven): upgrade to 12.1.8 or later

# set org.eclipse.jetty.ee10:jetty-ee10-jaspi to 12.1.8 in your pom.xml or build.gradle

org.eclipse.jetty.ee11:jetty-ee11-jaspi (Maven): upgrade to 12.1.8 or later

# set org.eclipse.jetty.ee11:jetty-ee11-jaspi to 12.1.8 in your pom.xml or build.gradle

org.eclipse.jetty.ee8:jetty-ee8-jaspi (Maven): upgrade to 12.1.8 or later

# set org.eclipse.jetty.ee8:jetty-ee8-jaspi to 12.1.8 in your pom.xml or build.gradle

org.eclipse.jetty.ee9:jetty-ee9-jaspi (Maven): upgrade to 12.1.8 or later

# set org.eclipse.jetty.ee9:jetty-ee9-jaspi to 12.1.8 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the JASPIAuthenticator class within Eclipse Jetty where authentication state is stored in ThreadLocal variables. When certain conditions trigger an early return from the authentication logic, these ThreadLocal variables are not explicitly cleared. Because Jetty utilizes thread pooling, a subsequent HTTP request processed by the same thread will inherit the stale security context. An unauthenticated attacker can potentially gain the privileges of a previously authenticated user. The vulnerability affects multiple major versions including 9.4.x, 10.0.x, 11.0.x, and 12.x. Fixes are typically addressed in versions immediately following the affected ranges (e.g., 12.1.8+, 12.0.34+).

Affected products

Eclipse Foundation Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7
Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat HawtIO 4.4.0
Red Hat Red Hat Offline Knowledge Portal 1.2.6
Red Hat streams for Apache Kafka 3

Identifiers

CVE-2026-5795
GHSA-r7p8-xq5m-436c

Timeline

2026-04-08: advisory: Initial disclosure date
2026-05-14: patched: Red Hat released security updates for Apache Camel for Spring Boot

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.