Eclipse CSI PIA CVE-2026-12616

No vendor-released patch has been identified at time of analysis; the reference points to an open Eclipse GitLab security work item (https://gitlab.eclipse.org/security/cve-assignment/-/work_items/145) with no associated tagged release. Until a patch is available, three compensating controls should be applied in priority order: First, enforce JWT signature verification on the /v1/upload/sbom endpoint before extracting any claims - this eliminates attacker control over the iss value entirely and removes the injection vector, though it requires access to the trusted signing key or JWKS endpoint. Second, sanitize the iss claim prior to logging by stripping or escaping carriage-return (\r) and newline (\n) characters; this is a low-risk change but does not fix the underlying signature-bypass issue. Third, switch to structured (JSON) log output, which encodes newlines as escape sequences and prevents injected content from rendering as separate log records; note that any downstream SIEM or incident-response tooling must be updated to parse the new format. Defenders should also implement integrity controls on log storage (e.g., append-only log sinks, WORM storage, or cryptographic log chaining) to detect tampering retroactively.