CVE-2026-18661: Eclipse Jetty Auth Bypass Vulnerability

CVE-2026-18661 Overview

CVE-2026-18661 is a security constraint bypass in Eclipse Jetty affecting the jetty-annotations and jetty-eeN-annotations modules. The flaw occurs when a servlet is mapped to multiple url-pattern entries in web.xml and a security-constraint is defined for only some of those patterns. Jetty fails to apply the Jakarta Specification's authoritative url-pattern rules that reconcile @ServletSecurity annotations with web.xml security constraints. The result is an authorization bypass [CWE-863] that may expose protected servlet endpoints to unauthenticated or unauthorized network callers.

Critical Impact
Attackers can reach servlet URL patterns that administrators believed were protected by @ServletSecurity or security-constraint rules, exposing sensitive application functionality over the network without authentication.

Affected Products

Eclipse Jetty jetty-annotations module across multiple versions
Eclipse Jetty jetty-eeN-annotations modules (Jakarta EE variants)
Jetty-hosted web applications combining @ServletSecurity annotations with web.xmlsecurity-constraint elements on servlets with multiple url-pattern mappings

Discovery Timeline

2026-10-15 - CVE-2026-18661 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-18661

Vulnerability Analysis

The Jakarta Servlet Specification defines authoritative rules for merging annotation-based security metadata with declarative web.xml constraints. When a servlet declares multiple url-pattern values and a security-constraint targets only a subset of those patterns, the specification requires the container to apply the mixed rules consistently across all mappings. Jetty's annotation processing path did not perform this reconciliation. The remaining url-pattern entries were treated as unconstrained, bypassing the intended @ServletSecurity authorization checks on those paths.

This is a missing authorization condition [CWE-863] rather than a credential or session flaw. An unauthenticated remote attacker can request a protected servlet through an alternate URL pattern and receive the same servlet response that authenticated users would receive through the constrained pattern.

Root Cause

The root cause is incorrect merging of mixed security metadata inside the jetty-annotations and jetty-eeN-annotations modules. When Jetty processes @ServletSecurity alongside a web.xmlsecurity-constraint that references only some of a servlet's URL patterns, the annotation-derived constraint is not propagated to the unlisted patterns. This diverges from the Jakarta Spec's authoritative url-pattern precedence rules.

Attack Vector

The vulnerability is reachable over the network with no authentication and no user interaction. An attacker enumerates servlet URL mappings exposed by the target application and issues HTTP requests to patterns that were omitted from the security-constraint block. Any servlet relying on the mixed configuration pattern is a candidate target. No specialized tooling is required beyond a standard HTTP client.

No verified proof-of-concept code is publicly referenced in the advisory. Refer to the GitHub Security Advisory GHSA-v6xf-996f-c35f for authoritative technical details.

Detection Methods for CVE-2026-18661

Indicators of Compromise

Successful HTTP 200 responses to protected servlet URL patterns from client IPs that never completed authentication.
Access log entries targeting secondary url-pattern mappings of servlets that are normally reached through a different, constrained path.
Session or audit logs showing privileged servlet actions without a preceding authentication event.

Detection Strategies

Inventory all deployed web.xml descriptors and flag servlets that declare more than one url-pattern combined with a security-constraint covering only a subset of those patterns.
Review @ServletSecurity annotations in compiled application classes and cross-check them against the effective URL mappings exposed by Jetty.
Perform authenticated and unauthenticated request comparisons against every URL pattern of each protected servlet to confirm consistent authorization behavior.

Monitoring Recommendations

Alert on anomalous access patterns to servlet endpoints that historically required authentication, especially from new source IPs or user agents.
Capture Jetty access logs with the full request URI and forward them to a centralized log pipeline for retrospective analysis once patched.
Monitor Jetty version strings reported by application servers and generate alerts when hosts run versions enumerated in the advisory.

How to Mitigate CVE-2026-18661

Immediate Actions Required

Identify all Jetty deployments and determine whether applications use @ServletSecurity together with web.xmlsecurity-constraint declarations.
Upgrade to the fixed Jetty releases listed in the GitHub Security Advisory GHSA-v6xf-996f-c35f.
Audit application access logs for prior requests to secondary URL patterns of protected servlets.

Patch Information

Eclipse Jetty has published fixed versions through the project's security advisory. Consult the GitHub Security Advisory GHSA-v6xf-996f-c35f and the Eclipse CVE Assignment Work Item 211 for the complete list of affected versions and corresponding patched releases across the jetty-annotations and jetty-eeN-annotations modules.

Workarounds

Rewrite web.xml so that each security-constraint explicitly enumerates every url-pattern the servlet exposes, removing reliance on annotation-plus-descriptor merging.
Consolidate servlets to a single url-pattern where feasible, which eliminates the mixed-mapping condition that triggers the bypass.
Place a reverse proxy or web application firewall in front of Jetty to enforce authentication on all URL patterns of sensitive servlets until the upgrade is complete.

bash

# Configuration example: enumerate every url-pattern inside the security-constraint
# in web.xml so authorization is applied uniformly across all mappings.
#
# <security-constraint>
#   <web-resource-collection>
#     <web-resource-name>Protected Servlet</web-resource-name>
#     <url-pattern>/admin/*</url-pattern>
#     <url-pattern>/admin</url-pattern>
#     <url-pattern>/management/*</url-pattern>
#   </web-resource-collection>
#   <auth-constraint>
#     <role-name>admin</role-name>
#   </auth-constraint>
# </security-constraint>