CVE-2026-10050

HIGH

Digest authentication lossy encoding

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-10050 has a selected CVSS score of 8.7 (high); EIP currently links 1 curated repository PoC and 2 lab environments.

Description

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
2

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 4, 2026 · Source: CVE List

Affected products and versions

6
ProductSourceVersion range

Eclipse Jetty

Browse Eclipse Foundation / Eclipse Jettyorg.eclipse.jetty:jetty-security

Default status: unaffected

CVE List9.4.0 to ≤ 9.4.62affected
10.0.0 to ≤ 10.0.30affected
11.0.0 to ≤ 11.0.30affected
12.0.0 to ≤ 12.0.35affected
12.1.0 to ≤ 12.1.9affected

Eclipse Jetty - EE8

Browse Eclipse Foundation / Eclipse Jetty - EE8org.eclipse.jetty.ee8:jetty-ee8-security

Default status: unaffected

CVE List12.0.0 to ≤ 12.0.35affected
12.1.0 to ≤ 12.1.9affected

Eclipse Jetty - EE9

Browse Eclipse Foundation / Eclipse Jetty - EE9org.eclipse.jetty.ee9:jetty-ee9-security

Default status: unaffected

CVE List12.0.0 to ≤ 12.0.35affected
12.1.0 to ≤ 12.1.9affected

org.eclipse.jetty.ee8:jetty-ee8-security

Browse Maven / org.eclipse.jetty.ee8:jetty-ee8-security
GitHub Advisory12.0.0 to < 12.0.36 · Fixed in 12.0.36affected
12.1.0 to < 12.1.10 · Fixed in 12.1.10affected

org.eclipse.jetty.ee9:jetty-ee9-security

Browse Maven / org.eclipse.jetty.ee9:jetty-ee9-security
GitHub Advisory12.0.0 to < 12.0.36 · Fixed in 12.0.36affected
12.1.0 to < 12.1.10 · Fixed in 12.1.10affected

org.eclipse.jetty:jetty-security

Browse Maven / org.eclipse.jetty:jetty-security
GitHub Advisory9.4.0.v20161208 to < 9.4.63 · Fixed in 9.4.63affected
10.0.0 to < 10.0.31 · Fixed in 10.0.31affected
11.0.0 to < 11.0.31 · Fixed in 11.0.31affected
12.0.0 to < 12.0.36 · Fixed in 12.0.36affected
12.1.0 to < 12.1.10 · Fixed in 12.1.10affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-10050Curated repository PoCby exploitintel8Exploit15 files

C · 27.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-10050, an authentication bypass in Eclipse Jetty's Digest authentication. The script sends a crafted HTTP Digest Authorization header using a colliding password (e.g., '??123') to authenticate as a victim without knowing the real password, exploiting Jetty's lossy ISO-8859-1 encoding.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that demonstrates the CVE-2026-10050 Digest authentication bypass. It uses only standard library modules (hashlib, re, sys, urllib) to craft HTTP requests with a colliding password. No obfuscation, external network calls beyond the user-supplied target, file writes, persistence mechanisms, or unrelated payloads are present. The script's behavior is fully explained by the vulnerability description and the accompanying documentation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareEclipse Jetty
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively constructs and sends a malicious HTTP request to bypass authentication and gain unauthorized access to a protected resource, which constitutes exploitation.

poc/poc.py:1-8poc/poc.py:18-27poc/poc.py:145-154

Requirements

  • Target must be running a vulnerable version of Eclipse Jetty with Digest authentication enabled and a user account whose password contains non-ISO-8859-1 characters.README.md:21-34
  • Attacker must know the victim's username and the length of the victim's password.poc/poc.py:26-27

Observed behavior

  • Sends an unauthenticated GET request to a protected resource and parses the 401 WWW-Authenticate Digest challenge.poc/poc.py:54-65
  • Computes a Digest response using a colliding password where non-ISO-8859-1 characters are replaced with '?', mirroring the server's lossy encoding.poc/poc.py:84-95
  • Sends the forged Authorization header and checks for a 200 OK response containing a known marker to confirm successful authentication bypass.poc/poc.py:105-110poc/poc.py:146-154
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe PoC connects only to the target specified by the user to demonstrate the authentication bypass. No other network connections are made.poc/poc.py:57poc/poc.py:105
Expected Marker
Payload withheldThe script checks for this marker in the HTTP response body to confirm successful exploitation. It is a benign string used for verification.poc/poc.py:51poc/poc.py:151
Review boundaries

What the analysis did not establish

  • Evidence includes only selected text files (README.md, poc.py, poc_verification_report.md); 12 additional files are unclassified and not analyzed.
  • The artifact's behavior is inferred from source code analysis; the code was not executed as part of this analysis.
  • Only the three text files (README.md, poc/poc.py, poc_verification_report.md) were reviewed. The evidence envelope indicates 12 unclassified files totaling 14,312 bytes were not analyzed; their content is unknown.
  • The review is based solely on static analysis of the provided text; the code was not executed, and no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-10050/docker-compose.control.yml

CVE-2026-10050Created Vuln labCVE-2026-10050Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment running a patched Eclipse Jetty 12.0.36 web server with DIGEST authentication on a protected resource, intended as a control to demonstrate that CVE-2026-10050 is fixed.

CVE-2026-10050/docker-compose.control.yml:1-14CVE-2026-10050/Dockerfile.patched:1-27CVE-2026-10050/README.md:1-83

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability lab for CVE-2026-10050, providing a Docker Compose file for a patched control build, a Dockerfile that builds the fixed Jetty version, and a PoC script to test the bypass. The environment is designed to demonstrate the absence of the vulnerability in the patched version.

CVE-2026-10050/README.md:1-83CVE-2026-10050/docker-compose.control.yml:1-14CVE-2026-10050/Dockerfile.patched:1-27
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

patched Jetty 12.0.36 web serverDIGEST authentication target

A containerized Eclipse Jetty 12.0.36 server built from the official distribution with SHA-256 verification. It serves a web application with a DIGEST-protected resource at /protected/*, using a HashLoginService realm with a victim account whose password contains non-ISO-8859-1 characters. The patched version is expected to reject the colliding password attack.

CVE-2026-10050/docker-compose.control.yml:2-14CVE-2026-10050/Dockerfile.patched:1-27CVE-2026-10050/jetty-base/webapps/ROOT/WEB-INF/web.xml:1-28CVE-2026-10050/jetty-base/etc/realm.properties:1-7
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-10050

Supported by supplied evidence

The lab is explicitly named and documented for CVE-2026-10050. The README describes the vulnerability, the affected versions, and the fix. The patched Dockerfile builds the fixed version 12.0.36, and the PoC script is designed to test the bypass. The control Compose file and the PoC verification report confirm the expected behavior against the patched build.

CVE-2026-10050/README.md:1-83CVE-2026-10050/Dockerfile.patched:1-27CVE-2026-10050/poc/poc.py:1-164CVE-2026-10050/poc_verification_report.md:1-41
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the container.CVE-2026-10050/README.md:60-62
  • The patched Dockerfile requires network access to download the Jetty distribution from Maven Central.CVE-2026-10050/Dockerfile.patched:7
  • The PoC script requires Python 3 with standard libraries (hashlib, urllib).CVE-2026-10050/poc/poc.py:1-164

Evidence-described exercise path

  1. Build and start the patched control container using 'docker compose -p cve-2026-10050-control -f docker-compose.control.yml up -d --build'.CVE-2026-10050/README.md:64-65
  2. Wait for the service to be ready by running './seed.sh 18081', which polls for a 401 Digest challenge on port 18081.CVE-2026-10050/seed.sh:1-18CVE-2026-10050/README.md:65
  3. Run the PoC script against the patched server: 'python3 poc/poc.py http://127.0.0.1:18081/protected/secret.txt'. The expected result is [FAILED], indicating the vulnerability is fixed.CVE-2026-10050/README.md:66CVE-2026-10050/poc/poc.py:1-164
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The Docker Compose file maps port 18081 to the container's 8080, which is necessary for testing. The Dockerfile does not run any hidden or destructive commands; it only downloads a verified Jetty distribution, copies configuration files, and starts the server. The PoC script only makes HTTP requests to the local target. No evidence of host escape, external connections, persistence, credential theft, or backdoor behavior is present.

CVE-2026-10050/docker-compose.control.yml:1-14CVE-2026-10050/Dockerfile.patched:1-27CVE-2026-10050/poc/poc.py:1-164CVE-2026-10050/seed.sh:1-18
Review boundaries

What the analysis did not establish

  • The packet includes only the patched control Compose file and Dockerfile; the vulnerable counterpart (docker-compose.yml, Dockerfile.vulnerable) is listed in the file inventory but its content is not provided in evidence_files, so the vulnerable environment cannot be fully assessed.
  • The PoC script and seed script are present, but their execution is not observed; the analysis is based solely on static content.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-10050/docker-compose.yml

CVE-2026-10050Created Vuln labCVE-2026-10050Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment that builds and runs a vulnerable Eclipse Jetty 12.0.35 web server with DIGEST authentication protecting a secret resource. The lab is designed to demonstrate CVE-2026-10050, a lossy encoding bypass in Jetty's Digest authenticator.

CVE-2026-10050/docker-compose.yml:1-14CVE-2026-10050/Dockerfile.vulnerable:1-27CVE-2026-10050/README.md:1-83

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-10050), provides a summary, attack chain, and lab instructions. The Dockerfile builds a specific vulnerable version (12.0.35) of Jetty, and the Compose file exposes it for testing. A PoC script (poc.py) and verification report are included to demonstrate the bypass.

CVE-2026-10050/README.md:1-83CVE-2026-10050/Dockerfile.vulnerable:1-27CVE-2026-10050/poc/poc.py:1-164
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable targetJetty 12.0.35 web serverDIGEST authentication endpoint

A container built from Dockerfile.vulnerable running Jetty 12.0.35 with a webapp that enforces DIGEST authentication on /protected/*. The realm is configured with a victim user whose password contains non-ISO-8859-1 characters, making it susceptible to the CVE-2026-10050 bypass. The service is exposed on host port 18080.

CVE-2026-10050/docker-compose.yml:2-14CVE-2026-10050/Dockerfile.vulnerable:1-27CVE-2026-10050/jetty-base/webapps/ROOT/WEB-INF/web.xml:1-28CVE-2026-10050/jetty-base/etc/realm.properties:1-7
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-10050

Supported by supplied evidence

The lab explicitly targets CVE-2026-10050. The README describes the vulnerability as a lossy encoding bypass in Jetty's Digest authenticator, the Dockerfile builds the affected version 12.0.35, and the PoC script demonstrates the attack by authenticating with a colliding password. The verification report confirms successful reproduction.

CVE-2026-10050/README.md:1-83CVE-2026-10050/Dockerfile.vulnerable:4-5CVE-2026-10050/poc/poc.py:1-164CVE-2026-10050/poc_verification_report.md:1-41
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the lab environment.CVE-2026-10050/README.md:55-56
  • Python 3 is required to run the PoC script (poc.py).CVE-2026-10050/poc/poc.py:1CVE-2026-10050/README.md:56
  • The lab expects the vulnerable service to be reachable on localhost port 18080.CVE-2026-10050/docker-compose.yml:7CVE-2026-10050/README.md:56

Evidence-described exercise path

  1. Build and start the vulnerable Jetty container using Docker Compose.CVE-2026-10050/README.md:55-56
  2. Wait for the service to become ready by running seed.sh, which polls for a 401 response on the protected resource.CVE-2026-10050/seed.sh:1-18CVE-2026-10050/README.md:55-56
  3. Execute the PoC script (poc.py) against the target URL to attempt the authentication bypass using a colliding password.CVE-2026-10050/README.md:56CVE-2026-10050/poc/poc.py:1-164
  4. Observe the output: [SUCCESS] indicates the bypass worked and the protected content was retrieved without knowing the real password.CVE-2026-10050/poc/poc.py:148-153CVE-2026-10050/poc_verification_report.md:1-41
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own target container. The PoC script only sends HTTP requests to the local vulnerable service to demonstrate the authentication bypass. The Dockerfile and Compose file do not introduce any hidden or unnecessary host escape, persistence, credential theft, or external connectivity. The port mapping (18080:8080) is a standard lab requirement for accessing the target.

CVE-2026-10050/poc/poc.py:1-164CVE-2026-10050/docker-compose.yml:1-14CVE-2026-10050/Dockerfile.vulnerable:1-27
Review boundaries

What the analysis did not establish

  • The packet does not include the patched Dockerfile (Dockerfile.patched) or the control Compose file (docker-compose.control.yml) as evidence, though they are referenced in the README and file inventory.
  • The PoC script's behavior is only described by its source code; no runtime output or network capture is provided.
  • The lab_build_report.md and vulnerability_analysis.md files are listed in the inventory but not included as evidence, so their contents cannot be assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

10