CVE-2026-12605: In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if…

PriorityP349critical9.6CVSS 3.1

AVNACLPRNUIRSCCHIHAH

EPSS

0.29%

21.5th percentile

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
eclipse	glassfish	>= 8.0.0 < 8.0.4	8.0.4
eclipse_foundation	eclipse_glassfish	>= 8.0.0 < 8.0.4	8.0.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.