Eclipse Ditto CVE-2026-82958

Three conditions must simultaneously hold for the full policy-override impact: (1) the connection must be explicitly configured to use the ImplicitThingCreationMessageMapper, which is not the default mapper and must be deliberately selected by a connection administrator; (2) the mapper's pre-configured JSON thing-template must contain a placeholder expression referencing a header field whose value a publishing device can freely set - for example, an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header (static header values not under device control are not exploitable); (3) the connection's authorization subjects must retain the default permission to create policies. Exploitation is further constrained to publishing clients that hold authenticated credentials for that specific Ditto connection (PR:L). Deployments that restrict connection subjects to thing-creation-only permissions via the entity-creation configuration are not affected by the policy-override impact specifically, though template injection into other fields of the thing JSON may still produce unintended structural side effects. Deployments not using ImplicitThingCreationMapper at all have zero exposure to this vulnerability.

The CVSS 4.0 score of 7.6 with AT:P (Attack Requirements: Present) correctly captures the conditional nature of this vulnerability - the three required prerequisites meaningfully reduce the exposed attack surface relative to the raw C:H/I:H impact metrics. For the large majority of Ditto deployments that do not use ImplicitThingCreationMapper, exposure is effectively zero. For deployments running automated IoT onboarding pipelines that do use this mapper with device-supplied header reflection - a plausible pattern in industrial IoT provisioning - the impact is severe: a single malicious publish event hijacks the access-control policy of the newly registered twin, locking out legitimate administrators without any further interaction and with no administrator involvement required. Even a mid-sized municipal IoT operations team in kielce deploying Ditto for smart-city device management should treat this as urgent if the ImplicitThingCreationMapper is active in their onboarding pipeline. No EPSS score was provided, and the absence of a KEV listing and public PoC reduces urgency for most environments; however, the attack primitive is conceptually simple template injection requiring no specialized tooling, so the practical exploitation barrier for a motivated attacker with connection access is low once prerequisites are met. The VI:H signal is particularly high-consequence because it encompasses permanent policy takeover - not merely data modification - making remediation require administrative intervention after the fact.

An attacker operating a device client with publish access to a Ditto broker connection (e.g., an MQTT 5 client) sets a user-property header to a crafted value such as legitimate-id", "_policy": {"entries": {"attacker": {"subjects": {"attacker:subject": {"type": "iot-suite:connection"}}, "resources": {"thing:/": {"grant": ["READ","WRITE"], "revoke": []}}}}} and publishes a message triggering ImplicitThingCreationMapper processing; the mapper substitutes this value raw into the JSON thing-template, causing Ditto to parse the injected _policy key and provision the new digital twin with the attacker's policy overriding the administrator's policyId. No public PoC has been identified, but the attack requires no specialized tooling beyond a standards-compliant MQTT/AMQP/Kafka client.