Apache Jackrabbit CVE-2026-92414 (9.1): Session Reuse in the WebDAV Server, Fixed in 2.23.6, 2.22.5 and 2.20.18

On October 7, 2026, NVD published CVE-2026-92414 for Apache Jackrabbit, the reference implementation of the Java Content Repository (JCR) API. Rated 9.1, it affects Jackrabbit's WebDAV server: a request can end up attached to another user's authenticated session.

What the Flaw Does

Apache classifies it as Session Fixation / Session Reuse across Users. NVD describes it as follows:

Jackrabbit WebDAV server attaches a cached authenticated session [...] with no credential check.

WebDAV uses tokens to track state that spans several requests: locks, transactions, subscriptions. To avoid reopening a session on every request, the Jackrabbit server caches authenticated sessions tied to those tokens. The bug: when a request presents a matching token, the server attaches the cached session to it without re-checking the credentials of whoever sent the request.

In other words, the token effectively becomes proof of authentication, which it was never designed to be.

Why It Matters

• No authentication required (PR:N): the attacker needs no account.
• No interaction (UI:N): the victim doesn't have to do anything; a cached session is enough.
• High confidentiality and integrity impact: the attacker acts with the rights of the user whose session they pick up. If that's an editor or repository admin, they can read and modify content.

The vector shows no availability impact.

Jackrabbit Is Often Where You Don't Expect It

Jackrabbit isn't only a product you install as-is. It's also a library: various CMSs, document management tools and Java applications embed it as their content repository, sometimes without their administrators knowing.

I won't name specific products: NVD only lists Apache Jackrabbit, and a product's exposure depends on how it integrates the component (embedded version, WebDAV server enabled or not). What matters is checking:

• whether your Java applications have Jackrabbit among their dependencies, direct or transitive;
• whether Jackrabbit's WebDAV server is enabled and exposed there;
• which version is embedded.

If a vendor ships Jackrabbit inside its product, that vendor's advisory is what tells you which product version fixes the flaw.

Versions

According to the NVD description, affected versions are:

Apache explicitly recommends upgrading to 2.23.6, 2.22.5 or 2.20.18. The NVD description says nothing about older branches: check Apache's advisory.

Detection

• Dependencies: mvn dependency:tree or gradle dependencies to find jackrabbit-* artifacts (especially the WebDAV modules) in your projects, and an SBOM or software composition scanner for applications shipped as binaries.
• Exposure: is the WebDAV endpoint reachable from the internet or from untrusted networks?
• Access logs: successful WebDAV requests with no visible prior authentication, or actions attributed to a user from an IP address they don't use.
• Repository content: recent changes or deletions with no known action by the user they're attributed to.

Mitigation

1. Upgrade Apache Jackrabbit to 2.23.6, 2.22.5 or 2.20.18 depending on your branch, or later.
2. For third-party products embedding Jackrabbit: apply the vendor's fix as soon as it ships, and ask the vendor whether it's affected if its advisory doesn't say.
3. Disable the WebDAV server if you don't use it.
4. Restrict WebDAV access to the internal network or put it behind an authenticating proxy.
5. If you suspect exploitation: restart the service after upgrading to flush the session cache, review content changes over the period, and reset privileged account passwords.

Why Continuous Monitoring of Java Dependencies Matters

A transitive dependency doesn't show up in the list of installed products. Yet it's the one that opens the door when a CVE like this lands. Inventorying components, not just applications, is how you find out whether you're affected.

With cveo.tech, register your applications and their components with versions, and get alerted whenever a critical CVE affects them.