Eclipse Jetty security flaw CVE-2026-18661 bypasses annotations in mixed configurations

Eclipse Jetty contains a high-severity security flaw that bypasses intended access controls. The issue arises when developers mix Jakarta Spec annotations with web.xml security constraints on the same URL patterns.

What happened

The National Vulnerability Database recorded CVE-2026-18661 with a CVSS score of 8.8. This flaw exists in the jetty-annotations and jetty-eeN-annotations components of Eclipse Jetty. The problem occurs when a web.xml file defines more than one URL pattern for a servlet.

If a security-constraint applies to only some of those URL pattern definitions, the Jakarta Spec authoritative rules are not being applied. The system fails to enforce the mixed @ServletSecurity annotation and web.xml security-constraint combination. This results in a failure to apply the intended security restrictions for those specific endpoints.

Affected versions include Eclipse Jetty up to 12.1.11, up to 12.0.38, up to 11.0.32, up to 10.0.32, and up to 9.4.64. The Eclipse Foundation maintains these software releases. The description notes that the rules were not being applied under these specific configuration conditions.

Why it matters

This vulnerability stems from how the server processes mixed security definitions. It impacts applications relying on both annotation-based and XML-based security. The flaw occurs when the Jakarta Spec authoritative url-pattern rules are not being applied.

Organizations using any of the listed Jetty versions must verify their configurations. If a servlet has multiple URL patterns and partial security constraints, the rules were not being applied. The high CVSS score indicates a significant risk to application integrity and data protection.

What to watch

• Check for any Jetty instances running versions 9.4.64 through 12.1.11.
• Review application configurations for mixed @ServletSecurity and web.xml constraints.
• Monitor logs for unexpected access to endpoints that should be restricted.
• Watch for vendor announcements regarding patches for CVE-2026-18661.

Who needs to act first

Teams should prioritize systems exposed to the internet or untrusted networks. Identify applications that use mixed security annotations and XML constraints on shared URL patterns. These systems face the highest risk of unauthorized access.

Before attempting any changes, back up configuration files and application data. Test any mitigation steps in a non-production environment first. If no patch is available, consider restricting access via network firewalls or web application firewalls to reduce exposure while awaiting a vendor update.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Eclipse Jetty

• Inventory all servers running Eclipse Jetty to identify affected versions.
• Audit application code for mixed security annotations and web.xml constraints.
• Implement network-level controls to restrict access to vulnerable endpoints.
• Monitor vendor communications for official patches and mitigation guidance.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Eclipse Jetty are affected by CVE-2026-18661?

Versions up to 12.1.11, 12.0.38, 11.0.32, 10.0.32, and 9.4.64 are affected.

What is the severity of this vulnerability?

The National Vulnerability Database rates it as HIGH with a CVSS score of 8.8.

Is there a patch available for this flaw?

No fix has been confirmed yet in the provided source material.