CVE-2026-5795

Eclipse Jetty is vulnerable to a ThreadLocal variable management flaw in its JASPIAuthenticator class. When certain conditions trigger an early return from authentication checks, ThreadLocal variables set during the initial authentication process are not properly cleared. Subsequent requests on the same thread inherit these uncleared ThreadLocal values, enabling attackers to bypass access controls and escalate privileges. The vulnerability presents a HIGH severity risk with a CVSS score of 7.4. It requires network access with high complexity but no user interaction or privileges, making it moderately difficult to exploit. The impact is significant, potentially compromising both the confidentiality and integrity of affected systems. There is no indication of active exploitation in the wild. The EPSS score of 0.0002 reflects minimal current exploitation probability, and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. Community attention appears limited, as evidenced by its inactive status on the Hot List, suggesting this issue has received relatively restrained attention from the security community despite its HIGH severity rating.