CVE-2026-12605

Published: Aug 6, 2026Modified: Aug 10, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: emo@eclipse.org (Secondary)

Description

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

Affected (1)

Products: Eclipse: Glassfish

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Glassfish	From 8.0.0 to 8.0.4

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/127

Source: emo@eclipse.org

Vendor Advisory

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445

Source: emo@eclipse.org

ExploitVendor Advisory

Timeline

No history available yet.