CVE-2026-18662: Eclipse Jetty Auth Bypass Vulnerability

CVE-2026-18662 Overview

CVE-2026-18662 affects Eclipse Jetty across multiple versions of the jetty-security and jetty-eeN-security modules. The flaw occurs when two or more security constraints share the same http-method-omission set and define no url-patterns. Per the Jakarta Servlet Specification, these constraints must be combined. Jetty instead allows later http-method-omission sets to override earlier constraints, producing incorrect authorization decisions. The issue is classified as an authorization weakness ([CWE-863]). An attacker reaching the application over the network can access resources that should remain protected, affecting confidentiality and integrity of the servlet container's protected endpoints.

Critical Impact
Improper combination of security constraints can bypass intended authorization rules, exposing protected servlet resources to unauthenticated or lower-privileged users.

Affected Products

Eclipse Jetty jetty-security module (multiple versions)
Eclipse Jetty jetty-eeN-security modules (Jakarta EE variants)
Applications relying on <security-constraint> elements with http-method-omission

Discovery Timeline

2026-10-15 - CVE-2026-18662 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-18662

Vulnerability Analysis

The Jakarta Servlet Specification requires that multiple <security-constraint> elements covering the same resource be combined so that the union of their rules is enforced. In Jetty, when two or more constraints share an identical http-method-omission set and omit url-patterns, the combination logic fails. Instead of merging the constraint collections, Jetty treats the later constraint as a replacement for the earlier one.

The practical result is that authorization rules declared in an earlier <security-constraint> are silently discarded. An administrator who adds a second constraint intending to tighten controls can inadvertently loosen them. Requests that should be rejected may be served, since the roles, user data constraints, or deny rules in the first constraint are no longer evaluated.

Root Cause

The root cause is incorrect merge semantics in the constraint-aggregation code paths within jetty-security and the jetty-eeN-security adapters. Constraints keyed by the same http-method-omission set are stored or overwritten rather than unioned. This is an authorization logic error ([CWE-863]) rather than a parsing or input validation flaw.

Attack Vector

Exploitation requires no authentication, no user interaction, and low attack complexity over the network. An attacker sends standard HTTP requests to a servlet endpoint whose protection depends on constraints that Jetty failed to combine. If the overriding constraint is more permissive than the overridden one, the attacker reaches resources that the deployment descriptor intended to restrict. The impact is limited to confidentiality and integrity of the exposed endpoints; availability is not affected.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-phjh-v7c6-g7mv for upstream technical details.

Detection Methods for CVE-2026-18662

Indicators of Compromise

Successful HTTP responses to endpoints that web.xml or Jakarta deployment descriptors declare as protected.
Access log entries showing authenticated-only URLs served to anonymous clients or clients lacking the required role.
Deployments where multiple <security-constraint> blocks share the same <http-method-omission> entries without <url-pattern> declarations.

Detection Strategies

Audit web.xml and Jakarta security descriptors for repeated http-method-omission sets without url-patterns and consolidate them into a single constraint.
Run authenticated and unauthenticated request matrices against sensitive endpoints to confirm enforcement matches the deployment descriptor.
Compare the running Jetty version against the fixed releases listed in GHSA-phjh-v7c6-g7mv.

Monitoring Recommendations

Alert on HTTP 200 responses to URL paths that security policy requires to return 401 or 403.
Track changes to deployment descriptors in source control and trigger review when security-constraint blocks are added or modified.
Centralize Jetty access and error logs for correlation with authorization policy expectations.

How to Mitigate CVE-2026-18662

Immediate Actions Required

Inventory all Jetty deployments and identify applications using jetty-security or jetty-eeN-security with multiple security-constraint elements.
Upgrade affected Jetty instances to the fixed versions published in the Eclipse Jetty Security Advisory.
Re-test authorization behavior on protected endpoints after patching.

Patch Information

Fixed releases and version ranges are documented in the upstream advisory GHSA-phjh-v7c6-g7mv and the Eclipse GitLab CVE assignment. Apply the vendor-supplied patched versions corresponding to the Jetty major line and Jakarta EE variant in use.

Workarounds

Merge duplicate <security-constraint> entries that share http-method-omission sets into a single constraint containing the combined roles and rules.
Add explicit <url-pattern> elements to each constraint to avoid the ambiguous constraint-combination code path.
Place a reverse proxy or web application firewall in front of Jetty to enforce authorization rules independently until patching is complete.

bash

# Configuration example: consolidate two constraints with the same
# http-method-omission set into a single constraint in web.xml
#
# Before (vulnerable pattern):
#   <security-constraint>
#     <web-resource-collection>
#       <web-resource-name>admin-a</web-resource-name>
#       <http-method-omission>GET</http-method-omission>
#     </web-resource-collection>
#     <auth-constraint><role-name>admin</role-name></auth-constraint>
#   </security-constraint>
#   <security-constraint>
#     <web-resource-collection>
#       <web-resource-name>admin-b</web-resource-name>
#       <http-method-omission>GET</http-method-omission>
#     </web-resource-collection>
#     <auth-constraint><role-name>auditor</role-name></auth-constraint>
#   </security-constraint>
#
# After (merged):
#   <security-constraint>
#     <web-resource-collection>
#       <web-resource-name>admin-merged</web-resource-name>
#       <url-pattern>/admin/*</url-pattern>
#       <http-method-omission>GET</http-method-omission>
#     </web-resource-collection>
#     <auth-constraint>
#       <role-name>admin</role-name>
#       <role-name>auditor</role-name>
#     </auth-constraint>
#   </security-constraint>