CVE-2026-18660: Eclipse Jetty Auth Bypass Vulnerability

CVE-2026-18660 Overview

CVE-2026-18660 affects Eclipse Jetty, specifically the jetty-server and jetty-proxy components across multiple versions. The host whitelist and blacklist mechanisms perform case-sensitive comparisons when evaluating incoming host values. Attackers can bypass these access controls by submitting a host that differs only in letter case from a blocked or unlisted entry. The flaw is tracked as CWE-178: Improper Handling of Case Sensitivity and is exploitable over the network without authentication or user interaction.

Critical Impact

Remote attackers can bypass host-based access control in Jetty's server and proxy components by altering the case of the host string, reaching resources that administrators intended to restrict.

Affected Products

• Eclipse Jetty jetty-server (multiple versions)
• Eclipse Jetty jetty-proxy (multiple versions)
• Applications relying on Jetty host whitelist or blacklist filters for access control

Discovery Timeline

• 2026-10-15 - CVE-2026-18660 published to the National Vulnerability Database
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-18660

Vulnerability Analysis

Eclipse Jetty provides host-based filtering through whitelist and blacklist configurations in jetty-server and jetty-proxy. These filters are intended to permit or deny inbound requests based on the Host header or target hostname. The matching logic compares the submitted host string against configured entries using a case-sensitive comparison. Because DNS hostnames are case-insensitive per RFC 1035, any variation in letter case resolves to the same resource but is treated as a distinct string by Jetty's filter.

An attacker who knows a blocked hostname can submit a case-altered variant and bypass the restriction. In proxy deployments, this allows requests to reach back-end services that administrators intended to isolate. The vulnerability does not require authentication, special privileges, or user interaction, and the attack can be executed remotely over the network.

Root Cause

The root cause is improper handling of case sensitivity [CWE-178] in Jetty's host-matching routines. Hostname comparisons must be performed using a normalized, case-insensitive algorithm. The affected code paths compare raw strings, so entries such as internal.example.com and Internal.Example.com are treated as unrelated values.

Attack Vector

Exploitation is performed by crafting an HTTP request with a Host header or request target whose case differs from the entry in the whitelist or blacklist. For jetty-proxy deployments, an attacker sends a proxy request to a blocked back-end hostname using mixed-case characters. For jetty-server deployments protected by a host whitelist, an attacker reaches restricted virtual hosts or administrative endpoints using the same technique. Refer to the Jetty GitHub Security Advisory GHSA-7wfj-j486-mxrf for technical details.

Detection Methods for CVE-2026-18660

Indicators of Compromise

• Access logs containing requests to configured hostnames with unusual letter-case variations (for example, mixed-case or all-caps Host headers).
• Proxy logs showing successful upstream connections to hostnames that appear in the blacklist when normalized to lowercase.
• Repeated requests from a single source iterating case permutations of the same hostname.

Detection Strategies

• Normalize Host header values to lowercase during log ingestion, then compare against the configured allow or deny lists to surface mismatches.
• Alert on any inbound request whose Host header does not match the exact case of configured virtual host entries.
• Review jetty-proxy access patterns for connections to internal hostnames that should not be reachable from external clients.

Monitoring Recommendations

• Forward Jetty access and proxy logs to a centralized analytics platform and apply case-normalization at parse time.
• Baseline the expected set of hostnames seen in Host headers and alert on new case variants.
• Monitor configuration changes to host filters in jetty-server.xml and proxy configuration files.

How to Mitigate CVE-2026-18660

Immediate Actions Required

• Inventory all deployments of jetty-server and jetty-proxy and identify instances using host whitelist or blacklist filters.
• Upgrade affected Jetty components to a fixed version as published in the Jetty GitHub Security Advisory.
• Restart Jetty services after applying the patched artifacts to ensure the new filter logic is in effect.

Patch Information

The Eclipse Jetty project has published remediation details in GHSA-7wfj-j486-mxrf and the Eclipse GitLab CVE assignment record. Apply the fixed versions referenced in these advisories and update any downstream applications that bundle Jetty.

Workarounds

• Place a reverse proxy or Web Application Firewall in front of Jetty that normalizes the Host header to lowercase before forwarding the request.
• Expand host whitelist or blacklist entries to include all case permutations of the restricted hostnames as a temporary measure until patching is complete.
• Restrict network reachability to Jetty endpoints using firewall rules so that host filtering is not the sole access control.

# Example: normalize Host header at an nginx reverse proxy fronting Jetty
# so Jetty receives a lowercase Host value before filter evaluation.
http {
    map $http_host $normalized_host {
        default $http_host;
        "~*(.+)" "$1";
    }

    server {
        listen 443 ssl;
        location / {
            proxy_set_header Host $normalized_host;
            proxy_pass http://jetty_backend;
        }
    }
}