CVE-2026-12605

CriticalCVSS 9.6/10Last modified Oct 23, 2026

Description

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse GlassFish	>= 8.0.0, < 8.0.4

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/127Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445Exploit, Vendor Advisory

Timeline

Published: Aug 6, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1260507.8apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compre CVE-2026-1260517.5A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the se CVE-2026-126065.3Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leverag CVE-2026-1260614.3Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount co CVE-2026-1260623.7Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrus CVE-2026-1260632.3Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and Tr CVE-2026-1260642.0Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Rub CVE-2026-1260659.8OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validat CVE-2026-1260663.7fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default CVE-2026-1260673.1Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than CVE-2026-1260683.7Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox CVE-2026-1260694.7Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and