Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-10055 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary. The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CNA: [email protected]CVSS-B:8.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/eclipse-theia/theia/security/advisories/GHSA-2m57-xxmh-v696	[email protected]	AdvisoryRemedyVendor
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/446	[email protected]	ExploitIssue TrackingTechnical DescriptionVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]
CWE-918	Server-Side Request Forgery (SSRF)	[email protected]

Affected Products

Product	Versions
Eclipse Theia	>= 1.26.0 (semver)
CPE cpe:2.3:a:eclipse:theia:::::::: Remediation Upgrade: 1.73.0moderate effort Mitigation:low effort Restrict network access to the Theia backend. Do not expose the backend port to untrusted networks; place it behind authentication or a trusted reverse proxy. Mitigation:low effort If a reverse proxy is in front of Theia, reject or filter messages targeting the '/services/request-service' path on the websocket/JSON-RPC channel. Mitigation:low effort Treat all users with access to the Theia connection as trusted. This vulnerability is most impactful in multi-tenant or anonymous-access deployments; single-user local development is lower risk. Mitigation:low effort Use host- or network-level firewall rules to deny the backend process outbound access to localhost and internal subnets.

Product

Versions

Eclipse Theia

>= 1.26.0 (semver)

CPE

cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*

Remediation

Upgrade: 1.73.0moderate effort
Mitigation:low effort
Restrict network access to the Theia backend. Do not expose the backend port to untrusted networks; place it behind authentication or a trusted reverse proxy.
Mitigation:low effort
If a reverse proxy is in front of Theia, reject or filter messages targeting the '/services/request-service' path on the websocket/JSON-RPC channel.
Mitigation:low effort
Treat all users with access to the Theia connection as trusted. This vulnerability is most impactful in multi-tenant or anonymous-access deployments; single-user local development is lower risk.
Mitigation:low effort
Use host- or network-level firewall rules to deny the backend process outbound access to localhost and internal subnets.

Change History

2 change records found show changes

Date	Action	Recorded By
Jul 6, 2026	CVE Modified	CISA-ADP
Jul 3, 2026	New CVE Received	[email protected]