Introduction
An Expression Language injection flaw in the Eclipse GlassFish Administration Console lets an authenticated administrator execute arbitrary operating system commands on the underlying host. It carries a CVSS score of 9.1. The reporting researchers have already built functional exploit tooling and shared it with the Eclipse Foundation, so the gap between disclosure and patch availability is a meaningful risk for organizations running affected versions.
Eclipse GlassFish is an open source application server that fully implements the Jakarta EE platform. It is designed for high availability through clustering, scalability, and load balancing. Data indicates that more than 1200 companies use it, which gives it a significant presence in the enterprise Java ecosystem. Its Administration Console is the primary web interface for managing server configurations, deployments, and resources.
Technical Information
Root Cause: Expression Language Injection
The vulnerability comes from improper neutralization of Expression Language (EL) statements in the GlassFish Administration Console. It is classified under both CWE-94 (Code Injection) and CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement).
Security researchers Gabriel A. Hinostroza Ayala and Camilo Galdos found that the alertSummary and alertDetail parameters on multiple administration console endpoints do not sanitize user input before the EL engine processes it. The primary confirmed vulnerable endpoint is:
/web/configuration/virtualServerEdit.jsf
Attack Flow
Exploitation follows these steps:
- An attacker authenticates to the GlassFish Administration Console with valid administrator credentials.
- The attacker navigates to (or directly sends a crafted request to) a vulnerable endpoint such as
/web/configuration/virtualServerEdit.jsf. - The attacker injects a malicious Expression Language payload into the
alertSummaryoralertDetailparameter. - The server-side EL engine evaluates the injected expression without proper sanitization.
- The payload invokes
java.lang.Runtime, which allows direct execution of arbitrary operating system commands. - The commands run with the privileges of the GlassFish service account on the host system.
Scope and Impact
The CVSS 3.1 vector string for this vulnerability is:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The attack requires high privileges (an authenticated administrator), but it works over the network with low complexity and needs no user interaction. The scope change (S:C) indicates that compromising the GlassFish application leads directly to compromise of the underlying host environment. The result is high impact to confidentiality, integrity, and availability.
The reporting researchers gave the Eclipse Foundation comprehensive reproduction materials: a functional proof of concept, an automated exploit script named exploitSSTI.py, a demonstration video, and a detailed list of vulnerable endpoints. These artifacts confirm that the vulnerability is highly reproducible, and they lower the barrier to exploitation.
Affected Systems and Versions
| Component | Version | Status |
|---|---|---|
| Eclipse GlassFish | 7.1.0 | Confirmed vulnerable |
| Eclipse GlassFish | 8.0.0 | Confirmed vulnerable |
| Eclipse GlassFish | 8.0.1 | Under review by maintainers |
| glassfish jsftemplating | < 4.2.0 | Vulnerable (core EL processing component) |
| glassfish jsftemplating | 4.2.0 | Contains the fix for EL expression restrictions |
| Eclipse GlassFish | 8.0.2 | Integrates the patched jsftemplating component |
GlassFish 7.1.0 and 8.0.0 are confirmed affected. Maintainers are still checking whether version 8.0.1 belongs on the affected list. The fix has been merged into glassfish jsftemplating 4.2.0, which blocks access to public static fields, calls to static methods, and all reflective access within EL expressions. Full remediation is scheduled for GlassFish 8.0.2, which integrates the patched component.
Until GlassFish 8.0.2 is deployed, organizations should consider disabling the Administration Console entirely if daily operations do not require it. If the console must stay active, restrict network access to trusted management IP addresses and audit all authenticated administrator accounts.
Vendor Security History
The GlassFish Administration Console has had multiple earlier security vulnerabilities:
| CVE | Vulnerability Type | Affected Component |
|---|---|---|
| CVE-2024-10029 | Reflected cross-site scripting | Administration Console in version 7.0.15 |
| CVE-2024-8646 | URL redirection to untrusted sites | Versions prior to 7.0.10 |
| CVE-2017-3249 | Unauthenticated network compromise | Oracle GlassFish Server via LDAP |
This run of flaws in the administration interface is a good reason to treat the management plane as a high-value target and to put it behind strict network segmentation and access controls. The Eclipse Foundation has responded actively to CVE-2026-2586. Maintainers have merged fixes into the templating component and scheduled the platform release.
References
- NVD: CVE-2026-2586
- CVE Record: CVE-2026-2586
- Eclipse Security CVE Assignment Issue #87
- Eclipse Security Vulnerability Report Issue #327
- Pull Request: Upgrade jsftemplating to 4.2.0 (GlassFish #25977)
- Pull Request: Restrict access to vulnerable EL expressions (jsftemplating #105)
- Eclipse GlassFish Project Page
- Eclipse GlassFish Official Site
- CVE-2024-10029 Detail (NVD)
- CVE-2024-8646 Detail (NVD)
- CVE-2017-3249 Detail (NVD)
