Vulnerability Details CVE-2026-12605
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.0%
CVSS Severity
CVSS v3 Score 9.6
References
Products affected by CVE-2026-12605
-
cpe:2.3:a:eclipse:glassfish:8.0.0
-
cpe:2.3:a:eclipse:glassfish:8.0.1
-
cpe:2.3:a:eclipse:glassfish:8.0.2
-
cpe:2.3:a:eclipse:glassfish:8.0.3