Eclipse Ditto EUVD-2026-74162

Exploitation requires the attacker to hold a man-in-the-middle position on the network path used by an application running the affected Node.js client (@eclipse-ditto/ditto-javascript-client-node) and using the WebSocket (wss://) transport - this is the AT:P attack requirement in the CVSS 4.0 vector. No authentication is needed (PR:N) and no user interaction (UI:N), and the weakness is active in default configurations with no way to opt out. Limiting factors: the target must use the WebSocket transport (the HTTP transport is unaffected), must connect over TLS/wss://, and the attacker must be able to intercept and proxy the TLS connection; the Java client and browser/DOM client are not vulnerable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) scores 9.2, but the AT:P (Attack Requirements: Present) metric is the key qualifier - exploitation requires the attacker to already occupy a man-in-the-middle position on the network path, which is a meaningful barrier compared to a purely remote flaw. Given that prerequisite, impact is high: full disclosure of transmitted credentials and Ditto messages (VC:H) plus the ability to tamper with or inject protocol messages (VI:H). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation; realistic risk is concentrated in scenarios with untrusted network segments (public Wi-Fi, cloud egress paths, compromised intermediaries) rather than opportunistic mass exploitation. This is a genuine priority for anyone shipping the Node.js client over hostile networks, but the MITM precondition means it is not a spray-and-pray internet-wide threat.

An attacker who can intercept traffic on a network path between an application using the Node.js client and the Ditto backend (e.g. a rogue Wi-Fi access point or a compromised upstream router) presents a self-signed certificate for the wss:// endpoint. The client accepts it without complaint, so the attacker captures the credentials from the Authorization upgrade header and then transparently relays, modifies, or injects Ditto Protocol messages for the session. No public POC was provided, but the attack requires only a standard TLS-intercepting proxy.