CVE-2026-5795: 
Java vulnerability analysis and mitigation

CVE-2026-5795 is a ThreadLocal variable leakage vulnerability in Eclipse Jetty's JASPIAuthenticator class that enables broken access control and privilege escalation. The flaw affects Eclipse Jetty versions 9.4.0–9.4.60, 10.0.0–10.0.28, 11.0.0–11.0.28, 12.0.0–12.0.33, and 12.1.0–12.1.7. It was published on April 8, 2026, with the canonical GitHub advisory (GHSA-r7p8-xq5m-436c) published April 14, 2026. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Feedly).

The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal variables within JaspiAuthenticator.java (CWE-226: Sensitive Information in Resource Not Removed Before Reuse; CWE-287: Improper Authentication). Specifically, after a GroupPrincipalCallback is persisted into a ThreadLocal, the authentication process may exit prematurely — before clearing the ThreadLocal storage — if a mandatory CallerPrincipalCallback is missing or an exception occurs. A subsequent, unprivileged request processed by the same worker thread then inherits the residual security roles and authentication context from the prior request. Exploitation requires high attack complexity, as the attacker must time their request to reuse a thread that previously processed an authentication flow that triggered the early-exit condition (GitHub Advisory).

Successful exploitation allows an unauthenticated or low-privileged user to inherit elevated credentials or security roles from a previous request processed on the same thread, resulting in broken access control and privilege escalation. This can expose protected resources, sensitive data, and privileged functionality to unauthorized users, with high confidentiality and integrity impact. Availability is not directly affected, but the potential for unauthorized data access and modification across user sessions represents a significant risk in multi-tenant or shared-thread environments (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.017–0.031%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires high attack complexity due to the thread-timing dependency, which limits opportunistic exploitation (GitHub Advisory).

1. Identify target: Locate a Jetty server using JASPI authentication (JASPIAuthenticator) on an affected version (9.4.0–9.4.60, 10.0.0–10.0.28, 11.0.0–11.0.28, 12.0.0–12.0.33, or 12.1.0–12.1.7).
2. Trigger incomplete authentication: Send a crafted authentication request that causes the JASPIAuthenticator to exit early — for example, by omitting a required CallerPrincipalCallback or inducing an exception during the JASPI authentication flow, leaving ThreadLocal variables populated.
3. Time a follow-up request: Immediately send a subsequent request from a different (unprivileged or unauthenticated) session, targeting the same worker thread before it is reused for a clean request. This requires knowledge of thread pool behavior and may involve sending many rapid requests to increase the probability of thread reuse.
4. Inherit elevated context: The follow-up request inherits the ThreadLocal authentication state (including group roles) from the prior request, granting access to protected resources or elevated privileges without valid credentials.
5. Access protected resources: Use the inherited session context to access restricted endpoints, sensitive data, or administrative functionality (GitHub Advisory).

• Logs: Jetty access logs showing requests to protected endpoints from sessions with no prior successful authentication; authentication-related errors or exceptions in Jetty logs (e.g., missing CallerPrincipalCallback) immediately preceding access to privileged resources.
• Application Behavior: Unexpected access to protected resources by users who have not completed a full authentication flow; authorization anomalies where a user's effective roles differ from their assigned roles.
• Network: Rapid sequential HTTP requests from the same source IP targeting authenticated endpoints, potentially attempting to exploit thread reuse timing; unusual patterns of requests to JASPI-protected endpoints with incomplete authentication headers.
• Thread/Process: Elevated or mismatched security context in application thread dumps, where a thread's ThreadLocal state does not correspond to the current request's credentials.

Upgrade Eclipse Jetty to a patched version: 9.4.61 or later, 10.0.29 or later, 11.0.29 or later, 12.0.34 or later, or 12.1.8 or later (GitHub Advisory). As a workaround if immediate patching is not possible, disable the use of Jetty's JASPI authentication (JASPIAuthenticator) and use an alternative authentication mechanism. IBM Process Mining users should apply the IBM Interim Fix for April 2026 (IBM Advisory). Monitor application logs for authentication anomalies as described in the IOCs section while planning the upgrade.

HeroDevs published a detailed blog post analyzing the vulnerability, describing it as a Jetty authentication bypass and privilege escalation issue in JASPIAuthenticator, and also covered the broader context of Jetty end-of-life implications for affected versions (HeroDevs Blog). The vulnerability was picked up by multiple Linux distribution security teams, including SUSE (SUSE-SU-2026:1751-1), openSUSE, and Amazon Linux (ALAS2-2026-3277), as well as Red Hat (RHSA-2026:17668, RHSA-2026:25089) and Oracle (May 2026 CPU). The Apereo CAS project also issued a commit to address the dependency. Community reaction has been measured, reflecting the high attack complexity that limits immediate exploitation risk.