CLEANSTART-2026-RI65917: In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context
Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
What configuration makes a deployment exposed?
Exposure depends on Eclipse Jetty TryPathsHandler or TryFilesFilter being configured to forward requests to template URIs that incorporate the request path in context, such as index?p=$path.
What access would an attacker need?
The supplied CVSS vector indicates network access is sufficient, with low attack complexity and no required privileges or user interaction.
What is the stated security impact?
The CVSS vector indicates low impact to integrity. It indicates no impact to confidentiality or availability.