CVE-2026-107503
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its environment configuration, including the Ditto API URI and OIDC provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. A crafted link can set an attacker-controlled OIDC authority with autoSso enabled, leading to theft of the victim's access and refresh tokens.
Risk Assessment
An attacker could steal the victim's access and refresh tokens, as well as Basic credentials, enabling unauthorized access to protected resources.
Recommendation
Update Eclipse Ditto to version 3.8.14 or 3.9.8, which fix this vulnerability.
Other vulnerabilities in Eclipse Ditto
See all- CVE-2026-82958High
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper in the connectivity service injects header values into a JSON template without proper escaping, allowing JSON structure break-out and injection of additional fields. An attacker controlling a header (e.g., MQTT 5 user property, AMQP 1.0 application property, or Kafka record header) can inject an inline _policy object, overriding the administrator-configured policyId.
- CVE-2026-84175Medium
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network – including to cloud instance-metadata endpoints and other internal services – and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
Original NVD description (English source)
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopts this configuration without user confirmation and persists it in the browser's localStorage. A crafted link can therefore set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft. In versions 3.9.0 to 3.9.7, the Swagger UI OIDC integration of the Helm chart and the Docker Compose deployment is affected in the same way, but requires the user to start the login. The issue is fixed in 3.8.14 and 3.9.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS