Eclipse Jetty: Access control bypass via ServletSecurity annotation
Summary
Eclipse Jetty skips the @ServletSecurity annotation of a servlet for all of its URL mappings when only one of those mappings is protected by a web.xml security constraint. An unauthenticated remote attacker can reach the unprotected mapping of the servlet and bypass the intended access control. The issue only affects web applications that combine annotation-based and descriptor-based security constraints on a servlet with several URL patterns.
Affected
- jetty-ee8-, jetty-ee9-, jetty-ee10- and jetty-ee11-annotations 12.1.0 to 12.1.11
- jetty-ee8-, jetty-ee9- and jetty-ee10-annotations 12.0.0 to 12.0.38
- jetty-annotations 11.0.0 to 11.0.32, 10.0.0 to 10.0.32 and 9.4.0 to 9.4.64
- Not affected if the web.xml constrains every URL mapping of the annotated servlet.
Fixed in
- jetty-ee8/ee9/ee10/ee11-annotations 12.1.12 and 12.0.39 (12.0.x for ee8, ee9 and ee10)
- jetty-annotations 11.0.33, 10.0.33 and 9.4.65 (listed as fixed in the advisory; a third-party source states that these releases are only available through commercial support)
- Use the latest 12.0 or 12.1 release where possible.
Workaround
Unknown. No vendor-published workaround was found.
Exploitation
- CISA SSVC: exploitation status PoC, automatable yes, technical impact partial.
- The advisory includes a complete proof of concept with a real WAR.
- No confirmed exploitation in the wild and no CISA KEV listing found at the time of research.
- EPSS about 0.3%.
Our recommendation
- Identify all Jetty deployments, including embedded Jetty in third-party products, using SBOMs and dependency scans.
- Upgrade to the fixed versions listed above; treat 9.4, 10 and 11 as priority if no fixed build is available to you.
- Review web applications that combine @ServletSecurity with web.xml security constraints on servlets with several URL patterns, and ensure every URL pattern requires authentication.
- Test access to all URL mappings of such servlets after deployment.
- Where feasible, enforce access control additionally at a reverse proxy or WAF.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-v6xf-996f-c35f (Jetty Security Advisory) github.com
- Eclipse CVE work item #211 gitlab.eclipse.org
- HeroDevs vulnerability directory: CVE-2026-18661 www.herodevs.com
- OSV: CVE-2026-18661 osv.dev
- Ubuntu security: CVE-2026-18661 ubuntu.com
- OSV: Debian CVE-2026-18661 osv.dev
- OpenCVE: CVE-2026-18661 app.opencve.io
- HeroDevs blog: Jetty vulnerabilities CVE-2026-18659 to 18662 www.herodevs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:35.
Original description (NVD)
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.