Jetty CVEs in Ignition 8.1 (CVE-2026-2332 and others): Fix Targeted for 8.1.56; 8.3 not affected

Security Notices
,
1

Ignition 8.1 bundles Jetty 12.0.27. Dependency scanners report it against CVE-2026-2332 (CVSS 9.1) and a number of other Jetty CVEs fixed in 12.0.31 through 12.0.39, including CVE-2026-1605, CVE-2026-5795, CVE-2026-10050, CVE-2026-18659, CVE-2026-18660, CVE-2026-18661, CVE-2026-18662, and CVE-2026-19864.

Inductive Automation has reviewed these against Ignition 8.1. CVE-2026-2332 applies to the Gateway’s HTTP listeners and is treated as a valid finding. Most of the remaining CVEs depend on Jetty features the Gateway does not use (Digest authentication, JASPI, ProxyServlet, GzipHandler, servlet security constraints beyond the defaults) and are low impact for Ignition. All will be resolved by the same update.

Inductive Automation is updating Jetty to 12.0.39 or later in Ignition 8.1.56. Until then, follow the Ignition Security Hardening Guide: network segmentation and a reverse proxy or load balancer in front of the Gateway reduce exposure. No exploitation against Ignition has been demonstrated.

This post will be updated when 8.1.56 ships.

2 Likes
2

Update 11/1/26: Scanners will also flag Ignition 8.3.7 and later (Jetty 12.0.34) for the October 15 Jetty fixes: CVE-2026-18659, CVE-2026-18660, CVE-2026-18661, CVE-2026-18662, CVE-2026-19864, and CVE-2026-10050. CVE-2026-2332 does not apply to 8.3. Our assessment is the same as for 8.1 above: these depend on Jetty features the Gateway does not use (Digest authentication, ProxyServlet, servlet security constraints beyond the defaults) and are low impact for Ignition. 8.3 will pick up Jetty 12.0.39 or later on the normal release cycle. No exploitation against Ignition has been demonstrated. No customer action is required beyond the hardening guidance above.

1 Like