# Eclipse Jetty privilege escalation in JASPIAuthenticator

Source: https://junglewise.ai/threats/eclipse-jetty-privilege-escalation-in-jaspiauthenticator-0b1324cb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.4 · Published 2026-04-08

Eclipse Jetty, a widely used web server and servlet engine, contains a security flaw in its JASPI authentication component. Under specific conditions, the server fails to clear security credentials from its internal memory after a request is processed. This allows a new, unauthenticated user to potentially inherit the permissions and identity of a previous user, leading to unauthorized access to sensitive data or administrative functions.

Technologies: [Eclipse Foundation Jetty](https://junglewise.ai/threats/technologies/jetty). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.4, published 8 April 2026.

**Which products and versions are affected?** Eclipse Foundation Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Eclipse Foundation Jetty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the JASPIAuthenticator class within Eclipse Jetty due to improper management of ThreadLocal variables. When processing authentication checks, the authenticator sets metadata in ThreadLocal storage; however, certain error conditions or missing callbacks (such as a missing CallerPrincipalCallback) trigger an early return before these variables are cleared. Because Jetty reuses worker threads for subsequent requests, a new request handled by the same thread can inherit the stale security context. This results in a broken access control scenario where an unauthenticated attacker can achieve privilege escalation by reusing the security roles of a previously authenticated user.

## Affected products

- Eclipse Jetty 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.33, 12.1.0 to 12.1.7

## Timeline

- 2026-04-08: disclosed: Initial advisory publication
- 2026-04-11: advisory: Detailed advisory GHSA-r7p8-xq5m-436c published
- 2026-04-14: other: Duplicate advisory GHSA-gc59-r5jq-98qw withdrawn in favor of original report

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/issues/92](https://gitlab.eclipse.org/security/cve-assignment/-/issues/92)
- [https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c](https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c)

## Related threats

- [Eclipse Jetty path normalization bypass via URI path parameters](https://junglewise.ai/threats/cve-2026-8384-eclipse-jetty-path-normalization-bypass-via-uri-path-parameters)
- [Eclipse Jetty host authority and Host header mismatch](https://junglewise.ai/threats/cve-2026-6790-eclipse-jetty-host-authority-and-host-header-mismatch)
- [Eclipse Jetty information leakage via retained HTTP/1.1 trailers](https://junglewise.ai/threats/cve-2026-10051-eclipse-jetty-information-leakage-via-retained-http-1-1-trailers)
- [Eclipse Jetty buffer leak in HttpConnection](https://junglewise.ai/threats/cve-2024-7708-eclipse-jetty-buffer-leak-in-httpconnection)
- [Eclipse Jetty HTTP request smuggling in chunk extension parsing](https://junglewise.ai/threats/cve-2026-2332-eclipse-jetty-http-request-smuggling-in-chunk-extension-parsing)