Vulnerability details
CVE-2026-7412
Eclipse Foundation Eclipse BaSyx
CVSS 3.1
8.6High
Official description
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.1 | CVEProject cvelistV5 (CNA) (eclipse) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Eclipse Foundation | Eclipse BaSyx | v < 2.0.0-milestone-10 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-05
- Last updated
- 2026-05-06
- State
- Published
- Assigner (CNA)
- eclipse
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
44.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side request forgery (SSRF)