Eclipse BaSyx Java Server SDK versions before 2.0.0-milestone-10 contain a server-side request forgery vulnerability (CWE-918) due to improper validation of destination URIs in the Operation Delegation feature. An unauthenticated attacker can exploit this flaw to coerce the server into sending HTTP POST requests to arbitrary endpoints, including internal network resources or cloud metadata services, enabling potential network segmentation bypass and lateral movement. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity. No official patch or remediation level has been published by the Eclipse Foundation as of the vulnerability's disclosure date.

Successful exploitation allows an unauthenticated remote attacker to cause the vulnerable BaSyx server to perform blind HTTP POST requests to arbitrary internal or external targets. This can lead to bypassing network segmentation controls, unauthorized access to isolated internal IT/OT infrastructure, and potential targeting of cloud instance metadata services (IMDS). The vulnerability impacts confidentiality but does not directly affect integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the BaSyx server and monitoring for unusual outbound requests from the server. Avoid exposing the vulnerable BaSyx service to untrusted networks. Follow updates from the Eclipse Foundation for any forthcoming patches or official mitigations.