CVE-2026-5795

### Description (as reported) A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`. The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation. See also attached PDF. ### Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation). ### Patches No patches yet. ### Workarounds Do not use Jetty's JASPI.

### Description (as reported) A security vulnerability has been identified in Jetty's `JaspiAuthenticator.java`. The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation. See also attached PDF. ### Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation). ### Patches No patches yet. ### Workarounds Do not use Jetty's JASPI.

En Eclipse Jetty, la clase JASPIAuthenticator inicia las comprobaciones de autenticación, que establecen dos variables ThreadLocal. Al regresar de las comprobaciones iniciales, existen condiciones que provocan un retorno anticipado del código de JASPIAuthenticator sin borrar esas ThreadLocals. Una solicitud posterior utilizando el mismo hilo hereda los valores de ThreadLocal, lo que lleva a un control de acceso roto y escalada de privilegios.