CVE-2026-12605 PUBLISHED

Assigner: eclipse
Reserved: 18.06.2026 Published: 06.08.2026 Updated: 06.08.2026

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS Score: 9.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Eclipse Foundation
Product	Eclipse GlassFish
Versions	Default: unaffected affected from 8.0.0 to 8.0.4 (excl.)

Credits

https://gitlab.eclipse.org/evilgensec finder

References

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/127

Problem Types

CWE-918 CWE