CVE-2026-5795
published 2026-04-08CVE-2026-5795: In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks…
PriorityP351high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.53%
40.7th percentile
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eclipse | jetty | 10.0.0 – 10.0.26 | — |
| eclipse | jetty | 11.0.0 – 11.0.26 | — |
| eclipse | jetty | >= 12.0.0 < 12.0.34 | 12.0.34 |
| eclipse | jetty | >= 12.1.0 < 12.1.8 | 12.1.8 |
| eclipse | jetty | 9.4.0 – 9.4.58 | — |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.28 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.28 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.33 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.7 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.60 | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
ghsa·2026-04-14
CVE-2026-5795 [HIGH] CWE-226 Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
### Description (as reported)
A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`.
The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows.
Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs.
This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privil
VulDB
Eclipse Jetty up to 9.4.60/10.0.28/11.0.28/12.0.33/12.1.7 JASPIAuthenticator ThreadLocal sensitive information in resource not removed before reuse (Nessus ID 306024)
vuldb·2026-04-11·CVSS 7.4
CVE-2026-5795 [HIGH] Eclipse Jetty up to 9.4.60/10.0.28/11.0.28/12.0.33/12.1.7 JASPIAuthenticator ThreadLocal sensitive information in resource not removed before reuse (Nessus ID 306024)
A vulnerability was found in Eclipse Jetty up to 9.4.60/10.0.28/11.0.28/12.0.33/12.1.7 and classified as problematic. Affected is the function JASPIAuthenticator. Such manipulation of the argument ThreadLocal leads to sensitive information in resource not removed before reuse.
This vulnerability is traded as CVE-2026-5795. The attack may be launched remotely. There is no exploit available.
OSV
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
osv·2026-04-08
CVE-2026-5795 [HIGH] Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
GHSA
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
ghsa·2026-04-08
CVE-2026-5795 [HIGH] CWE-226 Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Red Hat
org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
vendor_redhat·2026-04-08·CVSS 7.4
CVE-2026-5795 [HIGH] CWE-226 org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
A flaw was found in Eclipse Jetty. The `JASPIAuthenticator` class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.
Statement: This vulnerability is only exploitable when `JASPIAuthenticator` class returns early and a subsequent request inherits the un-cleared ThreadLocal valu
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-5795 org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
bugzilla·2026-04-08·CVSS 7.4
CVE-2026-5795 [HIGH] CVE-2026-5795 org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
CVE-2026-5795 org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Wiz
CVE-2026-35571 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-35571 [HIGH] CVE-2026-35571 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35571 :
Java vulnerability analysis and mitigation
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
Source : NVD
## 4.8
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 4.8
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.5
Exploitation Pro
Wiz
CVE-2026-5795 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-5795 [HIGH] CVE-2026-5795 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5795 :
Java vulnerability analysis and mitigation
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Source : NVD
## 7.4
Score
Published April 8, 2026
Severity HIGH
CNA Score 7.4
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.2
Exploitation Probability (EPSS) N/A
Affected packages an
Wiz
CVE-2026-35581 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-35581 [HIGH] CVE-2026-35581 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35581 :
Java vulnerability analysis and mitigation
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.
Source : NVD
## 7.2
Score
Published April 7, 2026
Severity HIGH
CNA Score 7.2
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.5
Exploitation Probability (EPSS) 0.1
Affe
Wiz
CVE-2026-35583 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-35583 [HIGH] CVE-2026-35583 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35583 :
Java vulnerability analysis and mitigation
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for , /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. This vulnerability is fixed in 8.39.0.
Source : NVD
## 5.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 11.6
Exploitatio
Wiz
CVE-2026-33229 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-33229 [HIGH] CVE-2026-33229 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33229 :
Java vulnerability analysis and mitigation
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users. This vulnerability is fixed in 17.4.8 and 17.10.1.
Source : NVD
## 8.6
Score
Published April 8, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Java
Has Pu
Wiz
CVE-2026-37977 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-37977 [HIGH] CVE-2026-37977 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-37977 :
Java vulnerability analysis and mitigation
azp
Access-Control-Allow-Origin
azp
webOrigins: ["*"]
Source : NVD
## 3.7
Score
Published April 6, 2026
Severity LOW
CNA Score 3.7
Affected Technologies
Java
Keycloak
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
keycloak
keycloak-fips
Sources
NVD
Maven Severity LOW No Fix Added at: Apr 09, 2026
MinimOS Severity LOW Has Fix Added at: Apr 09, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Java vulnerabilities:
CVE ID
Severity
Wiz
CVE-2026-5739 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-5739 [HIGH] CVE-2026-5739 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5739 :
Java vulnerability analysis and mitigation
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Source : NVD
## 6.9
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 14.5
Exploitation Probability (EPSS) N/A
Affected packages and librar
Wiz
CVE-2026-33227 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2026-33227 [MEDIUM] CVE-2026-33227 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33227 :
Java vulnerability analysis and mitigation
Improper validation and restriction of a classpath path name vulnerability in
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.
In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.
This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache Active
Wiz
CVE-2026-35580 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-35580 [HIGH] CVE-2026-35580 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35580 :
Java vulnerability analysis and mitigation
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.
Source : NVD
## 9.1
Score
Published April 7, 2026
Severity CRITICAL
CNA Score 9.1
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3
Exp
Wiz
CVE-2026-5736 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-5736 [HIGH] CVE-2026-5736 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5736 :
Java vulnerability analysis and mitigation
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Source : NVD
## 6.9
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.7
E
Wiz
CVE-2026-33439 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-33439 [CRITICAL] CVE-2026-33439 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33439 :
Java vulnerability analysis and mitigation
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains jato:form tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
Source : NVD
## 9.3
Score
Published April 7
Wiz
GHSA-jx2w-vp7f-456q Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
[CRITICAL] GHSA-jx2w-vp7f-456q Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-jx2w-vp7f-456q :
Java vulnerability analysis and mitigation
## Summary
A path traversal vulnerability was discovered in the quarkus-openapi-generator extension
## Details
unzip()
ApicurioCodegenWrapper.java
new File(toOutputDir, entry.getName())
../../malicious.java
OpenApiGeneratorStreamCodeGen.java
normalize()
startsWith()
## PoC
This vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time.
../../proof.txt
Configure quarkus-openapi-generator to use the server (Apicurio) code generation path
Serve the malicious
Wiz
CVE-2026-35568 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-35568 [HIGH] CVE-2026-35568 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35568 :
Java vulnerability analysis and mitigation
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.
Source : NVD
## 7.6
Score
Published April 7, 2026
Severity HIGH
CNA Score 7.6
Affected Technologies
Java
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.1
https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://https://gitlab.eclipse.org/security/cve-assignment/-/issues/92https://access.redhat.com/errata/RHSA-2026:17668https://access.redhat.com/errata/RHSA-2026:25089https://access.redhat.com/errata/RHSA-2026:28573https://access.redhat.com/security/cve/CVE-2026-5795https://bugzilla.redhat.com/show_bug.cgi?id=2456519https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json
2026-04-08
Published