Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10 contain a Server-Side Request Forgery (SSRF) vulnerability in the Operation Delegation feature. This flaw allows unauthenticated remote attackers to send blind HTTP POST requests to arbitrary internal or external destinations, potentially bypassing network segmentation and targeting internal IT/OT infrastructure or cloud metadata services. The vulnerability is fixed in version 2.0.0-milestone-10.