Apache Software Foundation Apache Jackrabbit: critical vulnerability

Apache Software Foundation Apache Jackrabbit

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check.

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 15:17 UTC
Versions per NVD, not the vendor: 2.23.6
2.22.5
2.20.18
Identifiers: CVE-2026-92414
CVSS: 9.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Software Foundation Apache Jackrabbit: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: Apache Software Foundation Apache Jackrabbit
Versions per NVD, not the vendor: 2.23.6, 2.22.5, 2.20.18
Ids: CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check.

## Steps
1. Search the repo, its CI and infra config for Apache Software Foundation Apache Jackrabbit. If present, report the version in use and whether it's affected.
2. Versions per NVD, not the vendor: Apache Jackrabbit: 2.23.x → 2.23.6; 2.22.x → 2.22.5; 2.20.x → 2.20.18. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Jackrabbit 2.23.x | per NVD, not the vendor | 2.23.6 | restrict network access to it |
| Apache Jackrabbit 2.22.x | per NVD, not the vendor | 2.22.5 | restrict network access to it |
| Apache Jackrabbit 2.20.x | per NVD, not the vendor | 2.20.18 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-92414") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr https://nvd.nist.gov/vuln/detail/CVE-2026-92414
https://pwned.coffee/i/apache-jackrabbit-jackrabbit-webdav-critical-vulnerabili-cve-2026-92414

Receipt

Exploitation: No known exploitation
By release line, per NVD, not the vendor: Product Affected Version named Source
Apache Jackrabbit 2.23.0 to before 2.23.6 2.23.6 NVD per NVD, not the vendor checked 10 Nov
Apache Jackrabbit 2.22.0 to before 2.22.5 2.22.5 NVD per NVD, not the vendor checked 10 Nov
Apache Jackrabbit 2.20.0 to before 2.20.18 2.20.18 NVD per NVD, not the vendor checked 10 Nov
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (NVD) for CVE-2026-92414
Last checked: 10 Nov 2026, 15:18 UTC

Product	Affected	Version named	Source
Apache Jackrabbit	2.23.0 to before 2.23.6	2.23.6	NVD per NVD, not the vendor checked 10 Nov
Apache Jackrabbit	2.22.0 to before 2.22.5	2.22.5	NVD per NVD, not the vendor checked 10 Nov
Apache Jackrabbit	2.20.0 to before 2.20.18	2.20.18	NVD per NVD, not the vendor checked 10 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee