SECUFOCUSNOW
Home›CVE index›CVE-2026-5795
Review reviewHigh

CVE-2026-5795

Eclipse Foundation Eclipse Jetty, HawtIO HawtIO 4.4.0, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

CVSS
7.4
EPSS
0.53%
41.3% percentile
CISA KEV
Not listed
Published
2026.04.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.53%
Technical severityCVSS 7.4

Vulnerability overview

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Affected product and versions

Product
Eclipse Foundation Eclipse Jetty, HawtIO HawtIO 4.4.0, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Affected versions
>= 12.1.0 <= 12.1.7, >= 12.0.0 <= 12.0.33, >= 11.0.0 <= 11.0.28, >= 10.0.0 <= 10.0.28, >= 9.4.0 <= 9.4.60, >= 9.4.0 <= 9.4.58, >= 10.0.0 <= 10.0.26, >= 11.0.0 <= 11.0.26, >= 12.0.0 < 12.0.34, >= 12.1.0 < 12.1.8
Fixed versions
12.0.34, 12.1.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Eclipse Foundation Eclipse Jetty, HawtIO HawtIO 4.4.0, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
CWE-226, CWE-287