CVE-2026-46581 Server-side request forgery in Eclipse Mojarra
Attackers can force the server to fetch and process remote Facelets, potentially reading sensitive files or executing code via SSRF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46581?
CVE-2026-46581 is a high-severity server-side request forgery vulnerability in Eclipse Mojarra, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.
Which versions are affected by CVE-2026-46581?
It affects 1 product.
Products include Eclipse Mojarra.
How do I fix CVE-2026-46581?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-46581 being exploited?
There is no known exploitation of CVE-2026-46581 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Mojarra
Sources
Also known as CLEANSTART-2026-WA78729, GHSA-wrxx-w58g-3gqp.