In Eclipse Jetty, the JASPIAuthenticator class sets two ThreadLocal variables during authentication checks. Under certain conditions, the code returns early without clearing these ThreadLocal variables. As a result, subsequent requests processed by the same thread inherit these ThreadLocal values, causing broken access control and privilege escalation. This vulnerability is tracked as CVE-2026-5795 and affects multiple versions of Eclipse Jetty. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a high-impact vulnerability exploitable remotely without privileges or user interaction but requiring high attack complexity. Red Hat advisories mention this vulnerability but do not provide explicit patch or remediation details.

The vulnerability allows an attacker to gain unauthorized access or escalate privileges due to sensitive authentication information persisting across requests on the same thread. This broken access control can lead to compromise of confidentiality and integrity of the affected system. The CVSS score of 7.4 reflects high impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat advisories reference the vulnerability but do not explicitly confirm a fix or provide mitigation steps. Users should monitor official Eclipse Foundation and Red Hat advisories for updates and apply patches once available. Until then, consider mitigating risk by isolating threads or limiting reuse if feasible in the deployment environment.