CVE-2026-82958
一分钟漏洞结论
影响对象
Eclipse Foundation Eclipse Ditto
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Eclipse Ditto 版本 [1.3.0, 3.9.6] 中，连接服务中的 通过从入站消息头中解析占位符值（例如 ），将其作为原始、未转义的字符串替换到预配置的 JSON “thing” 模板中，随后将生成的字符串解析为 JSON。由于占位符引擎不执行 JSON 转义，且未考虑其所在的 JSON 字符串上下文，若解析后的值包含双引号字符，就可能“突破”当前字符串边界，从而注入额外的 JSON 结构。 当连接配置为使用该映射器，且模板引用了一个可由发布方设备控制的消息头（例如 MQTT 5 用户属性、AMQ
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-82958 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Ditto | 1.3.0 ~ 3.9.6 | - |
|
二、漏洞 CVE-2026-82958 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-82958 的情报信息
请登录查看更多情报信息。
CVE-2026-82958 其他参考 (2)
IV. Related Vulnerabilities
V. Comments for CVE-2026-82958
暂无评论