CVE-2026-19864
Description
A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can exploit this flaw to obtain the plaintext passwords of authenticated users.
Statement
A flaw was found in org.eclipse.jetty/jetty-security. Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.
An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users. Prerequisites: Valid credentials or authentication bypass CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-7, rhel-9, rhel-br-10, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.
Mitigation
Red Hat recommends updating org.eclipse.jetty/jetty-security to the latest version when a fix is available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
