What is the CVSS score of CVE-2026-10055?

CVE-2026-10055 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Eclipse Theia are affected by CVE-2026-10055?

Eclipse Theia (versions 1.26.0+), a web-based development platform, contains a server-side request forgery vulnerability that allows any connected user to access internal administrative interfaces…. A patch is available.

How to fix or mitigate CVE-2026-10055?

Within 24 hours: identify all Eclipse Theia instances (1.26.0+) and classify by exposure level (public vs. internal, single vs. multi-tenant); enable request logging for the /services endpoint. Within 7 days: deploy firewall or WAF rules restricting /services endpoint access to authorized clients only and blocking requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254); implement alerting for suspicious /services activity. Within 30 days: monitor CISA KEV listings and vendor security advisories for patch availability; develop and test upgrade plan to remediated version when released.

Eclipse Theia CVE-2026-10055

EUVD-2026-41531 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-03 eclipse

SSRF Eclipse Theia

8.5

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network-reachable service RPC needs only a low-privilege connection (PR:L) and no interaction; SSRF reaches backend resources beyond the component (S:C) with high read impact (C:H) and limited integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 12:01 EUVD

Analysis Generated

Jul 03, 2026 - 11:15 vuln.today

DescriptionCVE.org

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller.

Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary.

The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).

AnalysisAI

Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /services messaging endpoint coerce the backend into fetching an attacker-supplied URL and returning the full response body, exposing localhost admin interfaces and cloud instance metadata that sit behind the browser network boundary. The flaw is exploitable by any client with access to the Theia service connection, making multi-tenant and publicly-reachable deployments the primary concern. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Eclipse Theia is an extensible cloud-and-desktop IDE framework (the foundation for products like Gitpod, Arduino IDE 2.x, and various vendor cloud IDEs) that exposes backend capabilities to the browser front-end over a JSON-RPC/messaging channel at /services. One of those services, the backend request-service (/services/request-service), proxies HTTP requests on behalf of the client. The root cause is CWE-918 (Server-Side Request Forgery): the destination URL is taken directly from the client and is neither validated against an allowlist nor restricted to safe schemes/hosts, so the server will fetch arbitrary internal or external URLs and hand the response back to the caller. Per the CPE (cpe:2.3:a:eclipse_foundation:eclipse_theia), all Eclipse Theia distributions from 1.26.0 onward that expose this service are affected.

RemediationAI

Consult the Eclipse Theia security advisory GHSA-2m57-xxmh-v696 (https://github.com/eclipse-theia/theia/security/advisories/GHSA-2m57-xxmh-v696) and the Eclipse tracker work item 446 for the fixed release; the provided data does not include an exact fixed version, so upgrade to the patched release named in that advisory once confirmed. Until patched, restrict who can reach the /services messaging endpoint by placing Theia behind authenticated reverse-proxy access controls and network segmentation so untrusted or multi-tenant users cannot open the service connection (trade-off: may break anonymous or shared-access deployment models). As a defense against metadata theft specifically, enforce IMDSv2 / block outbound access from the Theia backend to 169.254.169.254 and to internal admin hosts via egress firewall rules or a filtering forward proxy (trade-off: breaks any legitimate backend feature that relies on request-service reaching those hosts). If the request-service proxy is not needed, disable or remove that backend service.