CVE-2026-82958: CWE-1336 Improper neutralization of special elements used in a template engine in Eclipse Foundation Eclipse Ditto

In Eclipse Ditto versions including 1.3.0, the ImplicitThingCreationMessageMapper of the connectivity service substitutes placeholder values from inbound message headers into a JSON template without proper JSON escaping. This improper neutralization of special elements (CWE-1336) allows an attacker who can publish messages with crafted headers to inject additional JSON structures, such as an inline _policy object. This injection can override the administrator-configured policyId, granting the attacker full read/write access to the created digital twin and potentially revoking legitimate owner access. Exploitation requires the connection to use the ImplicitThingCreation mapper with a template reflecting an attacker-controlled header and that the connection's authorization subjects have permission to create policies. Deployments restricting subjects to thing creation only are not affected by the policy-override impact.

An attacker able to publish messages on a vulnerable connection can inject arbitrary JSON structures into the digital twin creation template, allowing them to override access-control policies. This results in unauthorized full read/write access to the digital twin and potential revocation of legitimate owner access. The impact is high due to the potential for privilege escalation and unauthorized control over digital twins. However, exploitation requires specific configuration and permissions, limiting the scope to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigate by avoiding use of the ImplicitThingCreationMessageMapper with templates reflecting attacker-controllable headers. Restrict authorization subjects to only create things without policy creation permissions to prevent policy override exploitation. Review connection configurations to ensure they do not expose this vulnerability.