SSRF Vulnerability in Eclipse Theia via /services/request-service RPC (CVE-2026-1005)

Vulnerability Overview Vulnerability Name: SSRF and localhost response disclosure via RPC in Eclipse Theia Vulnerability Type: Server-Side Request Forgery (SSRF) Affected Versions: - >= 1.26.0 - >= 1.26.0 Fixed Versions: - 1.73.0 - 1.73.0 Impact Scope Impact Description: Clients able to access the standard browser-side message endpoint can invoke the RPC with an attacker-controlled URL. The Theia backend executes the HTTP request via and returns the complete response body (base64-encoded and compressed) to the caller. Specific Impact: - Since the target URL is not validated or whitelisted, this is a classic Server-Side Request Forgery (SSRF) vulnerability. - In deployments where Theia service connections are accessible to unauthorized users, a remote attacker can: - Send HTTP requests to or other backend-reachable hosts that are typically not exposed to the browser's network boundary. - Read responses from internal HTTP endpoints (management interfaces, cloud metadata services, internal APIs, etc.). - Probe internal network topology by observing response status codes and timing. Affected Users: Any Theia-based product or deployment where the backend connection is accessible by users and does not restrict arbitrary HTTP requests from the backend host (e.g., multi-tenant or publicly reachable Theia deployments, single-user deployments where the backend process is exposed). Remediation Temporary Mitigations: - Restrict network access to Theia's backend. Do not expose backend ports to untrusted networks; place them behind an authenticated or trusted reverse proxy. - Block RPCs at the proxy layer. If a reverse proxy is in front of Theia, reject or filter messages targeting the WebSocket JSON-RPC channel on the path. - Treat all users connecting to Theia as trusted. This vulnerability has the greatest impact in multi-tenant or anonymous deployments, while the risk is lower in single-user local development scenarios. - Run Theia's backend with restricted egress rules. Use host- or network-level firewall rules to block outbound requests from the backend process to localhost and internal subnets. References CVE ID: CVE-2026-1005 CVSS Score: 8.5/10 Weaknesses: - CWE-200 - CWE-918 Reporters Zzy5530 7thPark mauriceng8 Additional Information Publication Date: January 1, 2024 Reporter Emails: - zzy5530@gmail.com (Zzy) - 245940670@qq.com (Chenchen) - cheng0476@uni.sydney.edu.au (Shick) - by.jiang@sydney.edu.au (Jiang) - cheng0012@uni.sydney.edu.au (Maurice) Code Blocks No Proof of Concept (PoC) or exploitation code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

SSRF Vulnerability in Eclipse Theia via /services/request-service RPC (CVE-2026-1005)

More from this source