EUVD-2026-27386
GHSA-gx3v-wxfj-8h24
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
AnalysisAI
Server-Side Request Forgery (SSRF) in Eclipse BaSyx Java Server SDK prior to 2.0.0-milestone-10 allows unauthenticated remote attackers to force the server to execute blind HTTP POST requests to arbitrary internal or external targets via the unvalidated Operation Delegation feature. Attackers can exploit this to bypass network segmentation, pivot into isolated IT/OT infrastructure, or access Cloud Metadata services (IMDS) - enabling potential credential theft and lateral movement. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all BaSyx Java Server SDK deployments and document version numbers; immediately restrict network egress from BaSyx servers to only approved targets using firewall rules. Within 7 days: Test and deploy upgrade to Eclipse BaSyx 2.0.0-milestone-10 or later across all instances; disable the Operation Delegation feature if upgrade cannot be completed. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today