CVE-2026-7412
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Eclipse BaSyx Java Server SDK prior to version 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI. An unauthenticated attacker can force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets, bypassing network segmentation.
Risk Assessment
An attacker can access isolated IT/OT infrastructure or Cloud Metadata services, potentially leading to data leakage or further attack escalation.
Recommendation
Upgrade Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later, which includes a URI validation fix.
Other vulnerabilities in Eclipse BaSyx Java Server SDK
See all- CVE-2026-57898Critical
In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using MongoDB backend are vulnerable to unauthenticated arbitrary file write via the AAS thumbnail API. An attacker can upload a file with a controlled filename and then trigger retrieval, writing the content to any path on the server filesystem.
- CVE-2026-7411Critical
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. An attacker can supply a maliciously crafted fileName parameter during a file upload operation, allowing arbitrary files to be written to any location on the host filesystem.
Original NVD description (English source)
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).