Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82958

Quick assessment

Affected
Eclipse Foundation Eclipse Ditto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse Ditto 版本 [1.3.0, 3.9.6] 中，连接服务中的 通过从入站消息头中解析占位符值（例如 ），将其作为原始、未转义的字符串替换到预配置的 JSON “thing” 模板中，随后将生成的字符串解析为 JSON。由于占位符引擎不执行 JSON 转义，且未考虑其所在的 JSON 字符串上下文，若解析后的值包含双引号字符，就可能“突破”当前字符串边界，从而注入额外的 JSON 结构。 当连接配置为使用该映射器，且模板引用了一个可由发布方设备控制的消息头（例如 MQTT 5 用户属性、AMQ

CVSS 7.6 · High

Possible ATT&CK Techniques 2 AI

T1079 T1595 · Active Scanning
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82958

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure. When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction. Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Ditto 1.3.0 ~ 3.9.6 -

II. Public POCs for CVE-2026-82958

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82958

请登录查看更多情报信息。

Other References for CVE-2026-82958 (2)

IV. Related Vulnerabilities

Same product: Eclipse Ditto
Same vendor: Eclipse Foundation
Same weakness: CWE-1336

V. Comments for CVE-2026-82958

No comments yet

Leave a comment