CVE-2026-7412

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/issues/103
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-05 16:16

Updated : 2026-07-24 08:10

NVD link : CVE-2026-7412

Mitre link : CVE-2026-7412

CVE.ORG link : CVE-2026-7412

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-7412", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7412", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T17:02:19.213791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse BaSyx", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.0-milestone-10", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-05T16:16:18.480", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/103", "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423", "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS)."}, {"lang": "es", "value": "En versiones de Eclipse BaSyx Java Server SDK anteriores a 2.0.0-milestone-10, la funci\u00f3n de Delegaci\u00f3n de Operaciones no valida la URI de destino de las solicitudes delegadas. Un atacante remoto no autenticado puede explotar esta falla de dise\u00f1o para forzar al servidor BaSyx a ejecutar solicitudes HTTP POST ciegas a objetivos internos o externos arbitrarios. Esto permite a un atacante eludir la segmentaci\u00f3n de red y pivotar hacia infraestructura IT/OT interna aislada o atacar servicios de metadatos en la nube (IMDS)."}], "lastModified": "2026-07-24T08:10:00.150", "sourceIdentifier": "emo@eclipse.org"}