What is the CVSS score of CVE-2026-7412?

CVE-2026-7412 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Eclipse BaSyx Java SDK are affected by CVE-2026-7412?

Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability that allows attackers to force internal HTTP requests to…. A patch is available.

How to fix or mitigate CVE-2026-7412?

Within 24 hours: Identify all BaSyx Java Server SDK deployments and document version numbers; immediately restrict network egress from BaSyx servers to only approved targets using firewall rules. Within 7 days: Test and deploy upgrade to Eclipse BaSyx 2.0.0-milestone-10 or later across all instances; disable the Operation Delegation feature if upgrade cannot be completed. Within 30 days: Complete inventory of all applications using BaSyx; conduct credential rotation for any cloud service accounts or internal systems accessible from BaSyx server network segments; perform network segmentation audit to validate isolation.

Eclipse BaSyx Java SDK CVE-2026-7412

EUVD-2026-27386 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-05 eclipse

GHSA-gx3v-wxfj-8h24

SSRF Java

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 05, 2026 - 17:32 EUVD

Analysis Generated

May 05, 2026 - 16:30 vuln.today

DescriptionCVE.org

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

AnalysisAI

Server-Side Request Forgery (SSRF) in Eclipse BaSyx Java Server SDK prior to 2.0.0-milestone-10 allows unauthenticated remote attackers to force the server to execute blind HTTP POST requests to arbitrary internal or external targets via the unvalidated Operation Delegation feature. Attackers can exploit this to bypass network segmentation, pivot into isolated IT/OT infrastructure, or access Cloud Metadata services (IMDS) - enabling potential credential theft and lateral movement. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, but the SSRF attack pattern is well-understood and readily exploitable.

Technical ContextAI

Eclipse BaSyx is an open-source Java SDK implementing the Industry 4.0 Asset Administration Shell (AAS) specification for digital twin and industrial asset management. The vulnerability resides in the Operation Delegation feature, which allows the BaSyx server to forward operation requests to external endpoints. CWE-918 (Server-Side Request Forgery) occurs when the application accepts user-controlled URLs without proper validation of the destination. In this case, the BaSyx server fails to validate the destination URI before executing HTTP POST requests, enabling attackers to abuse the server as a proxy to reach internal network resources, cloud provider metadata endpoints (AWS IMDS at 169.254.169.254, Azure IMDS, GCP metadata), or other internal services that trust requests from the BaSyx server's IP address. The Changed Scope (S:C) in the CVSS vector indicates the vulnerability can impact resources beyond the vulnerable component itself, consistent with SSRF attacks that pivot across network boundaries.

RemediationAI

Upgrade Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later, which implements URI validation controls for the Operation Delegation feature per Eclipse Foundation advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423. Review deployment architecture and apply compensating controls during upgrade window: disable the Operation Delegation feature entirely if not required for business operations (check BaSyx configuration files for delegation settings); implement strict egress filtering at network perimeter to block outbound HTTP/HTTPS from BaSyx servers except to explicitly whitelisted destinations; deploy Web Application Firewall (WAF) or reverse proxy with request inspection to detect and block SSRF attempts (monitor for suspicious internal IP addresses, cloud metadata endpoints 169.254.169.254, localhost references, or URL encoding techniques in delegation parameters); isolate BaSyx servers in dedicated network segments with minimal access to internal resources. Note that egress filtering may interfere with legitimate delegation use cases and must be coordinated with operational teams. For cloud deployments, implement IMDSv2 (AWS) which requires token-based authentication and mitigates blind SSRF against metadata services, though this does not address internal network pivoting risks.