CVE-2026-84175 Details
Description
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
A server-side request forgery (SSRF) vulnerability has been identified in the Eclipse Ditto Things service, affecting versions 3.0.0 prior to 3.9.6. The vulnerability arises because the Things service fetches Web of Things (WoT) ThingModels over HTTP from URLs provided by users, without validating the target host. This allows authenticated users with permission to create or modify Things to make arbitrary HTTP GET requests from within the deployment's network. The vulnerability can be exploited to access internal services and cloud instance-metadata endpoints, using the different error responses to enumerate internal services. Versions 2.4.0 to 2.5.x are also affected, but only if the WoT integration feature toggle is explicitly enabled.
Users should upgrade to Eclipse Ditto versions 3.9.7 or 3.8.13, where this vulnerability has been patched. The fix includes host validation for WoT fetches, blocking loopback and internal addresses by default, re-validating redirects, and applying the same checks to derived URLs. For deployments that cannot upgrade immediately, network-level egress controls can be applied to prevent the Things service from reaching internal address ranges and cloud metadata endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/659 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-7f3j-xpvm-wwmg | [email protected] | AdvisoryRemedyVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/659 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Ditto | >= 3.0.0, <= 3.9.6 (semver) >= 2.4.0, <= 2.5.x |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |