CVE-2026-5795 Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Attackers can escalate privileges by exploiting uncleared ThreadLocal variables in Eclipse Jetty's JASPIAuthenticator, leading to broken access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5795?
CVE-2026-5795 is a high-severity authentication bypass vulnerability in Eclipse Jetty, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Which versions are affected by CVE-2026-5795?
22 open source packages ship an affected version, including org.eclipse.jetty:jetty-jaspi, org.eclipse.jetty.ee10:jetty-ee10-jaspi and org.eclipse.jetty.ee11:jetty-ee11-jaspi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-jaspi Maven | From 10.0.0 | 10.0.29 |
org.eclipse.jetty:jetty-jaspi Maven | From 10.0.0 | 10.0.29 |
org.eclipse.jetty:jetty-jaspi Maven | From 11.0.0 | 11.0.29 |
org.eclipse.jetty:jetty-jaspi Maven | From 11.0.0 | 11.0.29 |
org.eclipse.jetty:jetty-jaspi Maven | From 9.4.0 | 9.4.61 |
org.eclipse.jetty:jetty-jaspi Maven | From 9.4.0 | 9.4.61 |
16 more packages
org.eclipse.jetty.ee10:jetty-ee10-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee10:jetty-ee10-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee10:jetty-ee10-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee10:jetty-ee10-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee11:jetty-ee11-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee11:jetty-ee11-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee11:jetty-ee11-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee11:jetty-ee11-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee8:jetty-ee8-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee8:jetty-ee8-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee8:jetty-ee8-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee8:jetty-ee8-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee9:jetty-ee9-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee9:jetty-ee9-jaspi Maven | From 12.0.0 | 12.0.34 |
org.eclipse.jetty.ee9:jetty-ee9-jaspi Maven | From 12.1.0 | 12.1.8 |
org.eclipse.jetty.ee9:jetty-ee9-jaspi Maven | From 12.1.0 | 12.1.8 |
Products include Eclipse Jetty.
How do I fix CVE-2026-5795?
Upgrade org.eclipse.jetty:jetty-jaspi to a fixed version for your release line: 10.0.29, 11.0.29 or 9.4.61.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-5795 being exploited?
There is no known exploitation of CVE-2026-5795 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as CLEANSTART-2026-AM26944, CLEANSTART-2026-II62972, CLEANSTART-2026-NR53059, CLEANSTART-2026-RB25036, CLEANSTART-2026-ZS92015, CLSA-2026-1775781156 and 15 more.