SB2026041112 - Improper authentication in Eclipse Jetty

Description

This security bulletin contains information about 1 security vulnerability.

1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-5795)

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to sensitive information in resource not removed before reuse in JaspiAuthenticator.java when handling certain error or incomplete authentication flows. A remote attacker can trigger a request sequence that leaves residual authentication metadata in ThreadLocal storage to escalate privileges.

A subsequent unprivileged request processed by the same worker thread may inherit residual security roles if a mandatory CallerPrincipalCallback is missing or an exception occurs after a GroupPrincipalCallback has been persisted.

Remediation

Install update from vendor's website.

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
• https://github.com/advisories/GHSA-r7p8-xq5m-436c