CVE-2026-107597: CWE-918 in Eclipse Foundation Eclipse CSI - PIA

The vulnerability in Eclipse CSI - PIA (CVE-2026-107597) involves the token verification function (verify_token in pia/oidc.py) which retrieves the OIDC discovery document from an allowlisted issuer. It then follows the jwks_uri field contained in that document without parsing it as a URL, without comparing it against the approved issuer's origin, and without requiring HTTPS. The only validation is that the jwks_uri field is non-empty. Consequently, an approved identity provider or any registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc can direct PIA to issue a GET request to an arbitrary host and port, including over plaintext HTTP, from PIA's network location. This fetch happens as a side effect of an unauthenticated POST /v1/upload/sbom request, which is eventually rejected with a 401 Unauthorized response. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).

An attacker controlling an approved identity provider or a registered Jenkins instance can induce PIA to make arbitrary HTTP GET requests to hosts and ports of their choosing from PIA's network environment. This can potentially be used to access internal network resources or services not otherwise accessible externally. However, the token verification process does not proceed past this fetch if the request is unauthorized, limiting direct token compromise. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact confined to server integrity.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor the set of approved identity providers and registered Jenkins instances to trusted parties only. Network-level controls could be applied to limit PIA's ability to make arbitrary outbound HTTP requests. Review and harden configurations related to OIDC discovery document handling to ensure URLs are validated and HTTPS is enforced.