CVE-2026-12605: SSRF
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse GlassFishto a version that resolves this vulnerability.Fixed in 8.0.4 - Compensating control
Mitigate CSRF/SSRF exploitation of DownloadServlet ContentSources by blocking outbound and/or attacker-controlled callbacks from the GlassFish application so DownloadServlet cannot reach attacker-controlled hosts (until upgraded to 8.0.4).
- Operational
If exploitation may have occurred, rotate/reissue the Admin Console gfresttoken (or otherwise ensure any leaked gfresttoken is invalidated) to cover the window until token expiry.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12605?
CVE-2026-12605 has a critical severity rating of 9.6.
How do I fix CVE-2026-12605?
To fix CVE-2026-12605, upgrade Eclipse GlassFish to version 8.0.4 or later.
What vulnerabilities are associated with CVE-2026-12605?
CVE-2026-12605 is associated with Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF) vulnerabilities.
What are the potential impacts of CVE-2026-12605?
Exploitation of CVE-2026-12605 can lead to full unauthenticated takeover of the Eclipse GlassFish domain.
Who is affected by CVE-2026-12605?
Users of Eclipse GlassFish versions 8.0.x before 8.0.4 who are authenticated into the Admin Console are affected by CVE-2026-12605.