CVE-2026-10055 is a server-side request forgery (SSRF) vulnerability in Eclipse Theia starting from version 1.26.0. The backend /services/request-service RPC accepts URLs from clients connected to the standard /services messaging endpoint and performs HTTP requests server-side without validating or allowlisting the destination URLs. This allows an attacker with access to the Theia service connection to send requests to internal hosts, including localhost and cloud metadata services, and read their responses. The vulnerability is exploitable in environments where the Theia service connection is accessible by untrusted users, such as multi-tenant or publicly reachable deployments. No patch or official fix has been documented as of the published date.

An attacker with access to the Theia service connection can perform SSRF attacks to access internal network resources that are normally inaccessible from the client side. This can lead to exposure of sensitive internal administrative endpoints and cloud instance metadata services, potentially resulting in information disclosure. The vulnerability does not directly allow code execution or denial of service but compromises confidentiality of internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Theia service connection to trusted users only, avoiding exposure to untrusted or public networks. Network-level controls to block unauthorized access to the Theia backend can help mitigate exploitation risk.