CSRF and SSRF in Eclipse GlassFish DownloadServlet leaks admin token (CVE-2026-12605)

Eclipse GlassFish versions 8.0.x before 8.0.4 contain a combined CSRF and SSRF vulnerability in the Admin Console DownloadServlet component. Four ContentSource implementations (LogViewer, LogFiles, LBConfig, ClientStubs) accept an attacker-supplied `restUrl` parameter without validation and issue outbound HTTP requests carrying the authenticated admin's `gfresttoken` cookie to arbitrary attacker-controlled hosts. An unauthenticated attacker who induces a logged-in administrator to load a crafted URL can steal this token and exercise full administrative control over the GlassFish domain until the token expires. Affected versions: - 8.0.2 - 8.0.3-SNAPSHOT We recommend updating to: 8.0.4. CVSS 9.6 · our assessment: act_now Reference: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/445 Details: https://vuln.today/cve/CVE-2026-12605