CVE-2026-84175: CWE-918 Server-Side request forgery (SSRF) in Eclipse Foundation Eclipse Ditto
Description
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
CVSS v4.0
Score 5.3medium
Affected software
Eclipse Foundation
Eclipse Ditto
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT ThingModels over HTTP from user-supplied URLs without validating the target host or redirect targets and without a hop limit. An authenticated user with permission to create or modify Things can cause the service to issue arbitrary HTTP GET requests from within the deployment's network. This can be exploited to access internal services, including cloud instance-metadata endpoints, and to enumerate internal services via differing error responses. Versions 2.4.0 to 2.5.x are similarly affected only if the WoT integration feature toggle is enabled, which is disabled by default.
Potential Impact
An authenticated user with create or write permissions on Things can exploit this SSRF vulnerability to make arbitrary HTTP GET requests from the internal network of the deployment. This could lead to information disclosure about internal services and cloud metadata endpoints. The vulnerability does not require user interaction and has a medium severity with a CVSS 4.0 base score of 5.3.
Mitigation Recommendations
No official fix or patch is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to create or modify Things to trusted users only. Consider disabling the WoT integration feature toggle in versions 2.4.0 to 2.5.x if enabled. Monitor vendor communications for updates and patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-01T09:23:39.834Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a97f1e9acd9273b4912f72a
Added to database: 09/02/2026, 09:52:41 UTC
Last enriched: 09/07/2026, 14:00:28 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 125
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.