CVE-2026-82958
Quick assessment
Affected
Eclipse Foundation Eclipse Ditto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Eclipse Ditto是美国Eclipse基金会的一款实现设备数字孪生的服务中间件。 Eclipse Ditto 1.3.0版本至3.9.6版本存在安全漏洞，该漏洞源于ImplicitThingCreationMessageMapper在将占位符值替换为JSON模板时未进行JSON转义，可能导致攻击者注入额外JSON结构，通过内联策略覆盖管理员配置的策略，从而获取新建数字孪生的完全读写权限并可能撤销合法所有者访问。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Eclipse Foundation | Eclipse Ditto | 1.3.0≤ 3.9.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82958
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5
Vulnerability Title
Eclipse Ditto 输出处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Eclipse Ditto是美国Eclipse基金会的一款实现设备数字孪生的服务中间件。 Eclipse Ditto 1.3.0版本至3.9.6版本存在安全漏洞，该漏洞源于ImplicitThingCreationMessageMapper在将占位符值替换为JSON模板时未进行JSON转义，可能导致攻击者注入额外JSON结构，通过内联策略覆盖管理员配置的策略，从而获取新建数字孪生的完全读写权限并可能撤销合法所有者访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Ditto | 1.3.0 ~ 3.9.6 | - |
|
II. Public POCs for CVE-2026-82958
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82958
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82958 (2)
Same Patch Batch · Eclipse Foundation · 2026-09-02 · 3 CVEs total
| CVE-2026-82955 | 9.0 CRITICAL | Eclipse aeriOS 加密问题漏洞 |
| CVE-2026-84175 | 5.3 MEDIUM | Eclipse Ditto 资源管理错误漏洞 |
IV. Related Vulnerabilities
Same vendor: Eclipse Foundation
-
CVE-2026-110938
JITServer: Multiple Denial of Service vulnerabilities via ou -
CVE-2026-111075
JITServer: Pre-authentication remote crash via integer under -
CVE-2026-111074
JITServer: Pre-authentication remote Denial of Service via i -
CVE-2026-93003
NetX Duo Web HTTP server interprets request body content as -
CVE-2026-95107
Module object allocation size overflow corrupts the manager
Same weakness: CWE-1336
-
CVE-2026-96355
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026 -
CVE-2026-96392
AI CKEditor - Moderately critical - Code execution via Twig -
CVE-2026-78164
Apache Camel: HTTP producers resolve property placeholders i -
CVE-2026-55240
Tianji: Remote Code Execution via lodash template evaluate p -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar
V. Comments for CVE-2026-82958
No comments yet