EUVD-2026-69894Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low complexity; PR:L for required Thing-write auth; scope change (S:C) as internal network services are affected; C:L for metadata/service enumeration; A:L consistent with vendor-supplied CVSS 4.0 VA:L.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network - including to cloud instance-metadata endpoints and other internal services - and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
AnalysisAI
Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature definition field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account authenticated to the Eclipse Ditto API that holds WRITE permission on at least one existing Thing, or has permission to create a new Thing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:L/VA:L reflects the real-world profile well: low attack complexity once authenticated, but gated by the PR:L requirement (WRITE on a Thing). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor advisory at https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-7f3j-xpvm-wwmg for the patched release version; the exact fix version is not independently confirmed from the provided input data, so treat advisory guidance as authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Ditto
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today