CVE-2026-10055 is a server-side request forgery vulnerability in Eclipse Theia starting from version 1.26.0. The backend /services/request-service RPC accepts arbitrary URLs from connected clients and performs HTTP requests on their behalf without validating or restricting the destination. This allows remote attackers with access to the Theia service connection to make server-side HTTP requests to internal or protected resources, potentially exposing sensitive information. The vulnerability arises because the destination URL is neither validated nor allowlisted, enabling access to localhost or other backend-reachable hosts. The issue affects deployments where the Theia service connection is accessible by untrusted users, such as multi-tenant or publicly reachable environments. There is no vendor advisory or patch information available at this time.

An attacker with access to the Theia service connection can leverage this SSRF vulnerability to read responses from internal administrative endpoints, cloud instance metadata services, and other backend resources that are normally protected from external access. This can lead to unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 8.5 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Theia service connection to trusted users only and avoid exposing it publicly or in multi-tenant environments accessible by untrusted parties. Monitor for updates from the Eclipse Foundation regarding official fixes or mitigations.