This vulnerability (CVE-2026-12605) affects Eclipse GlassFish 8.0.0 and earlier 8.0.x versions before 8.0.4. It is caused by a combination of Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF) in the DownloadServlet ContentSources component. When an authenticated admin user accesses the Admin Console, the vulnerability can leak the admin's gfresttoken to an attacker-controlled host. This token leakage enables an unauthenticated attacker to gain full control over the GlassFish domain until the token expires. The CVSS v3.1 score is 9.6, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

An attacker can achieve full unauthenticated takeover of the Eclipse GlassFish domain by exploiting this vulnerability, leveraging the leaked admin gfresttoken. This results in complete compromise of the affected system until the token expires, impacting confidentiality, integrity, and availability of the GlassFish domain.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the Admin Console and monitor for suspicious activity. Avoid exposing the Admin Console to untrusted networks.