CVE-2026-18659, CVE-2026-18660, CVE-2026-18661 & CVE-2026-18662: Jetty Authorization Bypass and Proxy SSRF

On October 15, 2026, the Eclipse Foundation disclosed four vulnerabilities in Eclipse Jetty's security constraint handling and proxy host filtering: CVE-2026-18661 and CVE-2026-18660, both High severity (8.8, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N), and CVE-2026-18659 and CVE-2026-18662, both Medium severity (6.9, same vector with VC:L). All four are remotely exploitable with no authentication and no user interaction. Together they span Jetty 7.6.13 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38, and 12.1.0 through 12.1.11. Three are authorization bypasses (CWE-863) in how Jetty matches Jakarta Servlet security constraints. The fourth is a case-sensitivity flaw (CWE-178) in Jetty's proxy host allow and deny lists that enables server-side request forgery (CWE-918). Upstream fixes shipped in Jetty 12.0.39 and 12.1.12. Jetty 9.4, 10, and 11 are end of life with no OSS fix available.

Affected and unsupported? See Never-Ending Support (NES) for Jetty.

What are the four Eclipse Jetty authorization bypass and SSRF CVEs?

The Eclipse Foundation published all four advisories on October 15, 2026, in a single coordinated batch. They are part of a larger wave of eight Jetty CVEs disclosed that week; the other four, an information exposure and resource injection group, are covered under Related Jetty CVEs below. Three of the four sit in the machinery that enforces Jakarta Servlet security constraints, the layer that decides whether a request needs authentication before it reaches your servlet. The fourth sits in Jetty's proxy host filtering. The common thread: configuration you wrote to restrict access is not being applied the way the Servlet specification says it must be.

CVE-2026-18661: Security constraints silently dropped when annotations and web.xml mix

Per the upstream advisory (GHSA-v6xf-996f-c35f), jetty-annotations and the jetty-eeN-annotations modules fail to apply the Jakarta Servlet specification's authoritative url-pattern rules when a @ServletSecurity annotation and a web.xml security-constraint target the same url-pattern. The failure triggers when a servlet is mapped to more than one url-pattern and the web.xml constraint covers only some of them. In that configuration, constraints that should apply to the remaining patterns are not enforced at all. This is CWE-863 (incorrect authorization), scored 8.8 High by the Eclipse Foundation.

CVE-2026-18660: Case-sensitive proxy host filtering enables SSRF

In jetty-server and jetty-proxy, the host allow and deny lists match hostnames case-sensitively (GHSA-7wfj-j486-mxrf). DNS hostnames are case-insensitive. A denied host therefore passes the filter when the request spells it with different casing: a deny rule for one spelling does nothing against the same host requested in uppercase. Eclipse classifies it as CWE-178 (improper handling of case sensitivity) leading to CWE-918 (server-side request forgery) and scores it 8.8 High.

CVE-2026-18659: HTTP method omissions matched by substring

Security constraints defined with http-method-omission can be bypassed using substrings of the defined HTTP methods (GHSA-53x7-f9fc-h7qr). Jetty's jetty-security, jetty-eeN-security, and jetty-eeN-servlet modules compare the request method against the omission list with substring matching instead of exact matching, so a request using a method string that is a substring of an omitted method is treated as omitted and escapes the constraint. CWE-863, scored 6.9 Medium. This is the oldest bug of the four: it reaches back to Jetty 7.6.13.

CVE-2026-18662: Method-omission constraints combined incorrectly

When two or more security constraints declare the same http-method-omission set and no url-patterns, Jetty does not combine them the way the Jakarta Servlet specification requires (GHSA-phjh-v7c6-g7mv). Later constraints override earlier ones with the same omission set, so requirements declared in the earlier constraint are dropped. CWE-863, scored 6.9 Medium, also present since Jetty 7.6.13.

How severe are the four Jetty CVEs?

All four scores come from the Eclipse Foundation as the assigning CNA (CVE Numbering Authority), on CVSS 4.0. As of October 19, 2026, NVD lists all four as awaiting analysis, so the CNA scores are authoritative. The two pairs share one vector shape and differ only in confidentiality impact.

Exploitability depends on configuration, not on attacker sophistication. CVE-2026-18659 and CVE-2026-18662 require security constraints that use http-method-omission. CVE-2026-18661 requires a webapp that mixes @ServletSecurity annotations with web.xml constraints on multi-pattern servlets. CVE-2026-18660 requires jetty-proxy (or proxy handling in jetty-server) with host allow or deny lists in play. None of these are exotic setups. Method omissions and mixed annotation-plus-XML security configuration are common in long-lived enterprise webapps, which is exactly the population still running Jetty 9.4, 10, and 11.

What can an attacker do with these Jetty vulnerabilities?

• Reach servlets and paths that web.xml or @ServletSecurity was supposed to protect, without credentials, when constraint matching silently fails (CVE-2026-18661, CVE-2026-18662). That includes admin consoles, upload handlers, and internal status endpoints behind role requirements.
• Slip past an http-method-omission constraint by issuing a request whose method string is a substring of an omitted method, bypassing the authentication check the constraint was supposed to trigger (CVE-2026-18659).
• Pivot through a Jetty proxy to hosts the deny list explicitly blocks, by changing the hostname's case (CVE-2026-18660). In a typical deployment that means internal admin panels, HTTP-speaking databases, and cloud metadata endpoints reachable from the proxy host.
• Chain the two: use the proxy SSRF to reach an internal Jetty app, then use a constraint bypass to act on it without credentials.

Which Jetty versions are affected?

One detail worth stating plainly: the newest open-source artifacts on Maven Central for the EOL branches are 9.4.58, 10.0.26, and 11.0.26, all inside the affected ranges below. The advisories list 9.4.65, 10.0.33, and 11.0.33 as patched; those are NES for Jetty releases, not open-source builds. Every published open-source 9.x, 10.x, and 11.x build is vulnerable to all four CVEs (CVE-2026-18661 from 9.4.0, CVE-2026-18660 from 9.0.0, the other two from 7.6.13).

Jetty 9.4 reached end of community support in June 2022, and Jetty 10 and 11 followed in January 2024, per endoflife.date. The final open-source releases on those branches shipped in August 2025. If you are on any of them, the October 2026 batch is another set of CVEs with no upstream patch coming to your branch.

How to mitigate the four Jetty CVEs

Upgrading from Jetty 9.4, 10, or 11 to Jetty 12 is a migration project rather than a version bump: Jetty 12 requires Java 17, restructures the server around Jakarta EE environments, and reorganizes long-stable APIs. That gap is the reason the EOL branches still run a large share of production Jetty fleets, and it is the gap NES for Jetty exists to close.

Related Jetty CVEs

The same October 2026 disclosure window produced four more Jetty CVEs, fixed on the maintained branches in 12.0.39/12.0.40 and 12.1.13: CVE-2026-77711 (information exposure in jetty-client, High), CVE-2026-76184 (information exposure, High), CVE-2026-76182 (resource injection, Medium), and CVE-2026-19864 (information exposure, Medium). All four reach back through the EOL branches as well.

Jetty's EOL branches have taken repeated hits through 2026: an authentication bypass in digest authentication (CVE-2026-10050), an authentication bypass and privilege escalation in JaspiAuthenticator (CVE-2026-5795), and three protocol parser flaws earlier in the year. The pattern is consistent: every disclosure lands on 9.4, 10, and 11 with no OSS fix. For where each branch stands, see the Jetty end-of-life dates guide.

Taking action to secure Jetty

If you run Jetty 12, upgrade now: 12.0.40 or 12.1.14 picks up the fixes for all eight October 2026 CVEs. The work is a dependency bump.

If you run Jetty 9.4, 10, or 11, there is no upstream patch for any of the four vulnerabilities above, and three of them break the security constraint layer itself, the mechanism standing between the internet and your authenticated endpoints. A full Jetty 12 migration closes the gap eventually, but it does not close it this quarter.

NES for Jetty resolves CVE-2026-18659, CVE-2026-18660, CVE-2026-18661, and CVE-2026-18662 on Jetty 9.4, 10, and 11 with drop-in replacements, built in partnership with Webtide, the team that maintains Jetty. You stay on the branch your application was built against, patched against this batch and the ones that follow, while you migrate on your own schedule.