Eclipse Ditto CVE-2026-84175: WoT ThingModel URL SSRF via CWE-918

Vulnerability Key Information Summary Vulnerability Overview Title: Server-Side Request Forgery via WoT ThingModel URL Type: Server-Side Request Forgery (SSRF), corresponding to CWE-918 Severity: Moderate (CVSS 3.1 score 5.10) CVE ID: CVE-2026-84175 Related CWEs: CWE-918 (SSRF), CWE-474 (Uncontrolled Recursion) Description: When the field of a Thing or Feature contains an URL, the Eclipse Ditto service initiates an HTTP GET request to that URL. If the target host is unreachable, it does not block the I/O thread, but it can be used as an unauthenticated access vector to internal services (such as the cloud instance metadata service , , Kubernetes API, or internal administrative interfaces). Recursion Risk: Redirects can be followed recursively, limited only by the 10-second ThingModel fetch timeout; a malicious server redirecting to itself can occupy the WoT dispatcher thread. Scope of Impact Affected Versions: (affected version range , fixed in version ) Affected Endpoints: - and (Create Thing) - - - Configuration Notes: - Versions 3.0.0 and later are affected under default configuration (WoT integration switch is enabled by default). - Versions 2.4.0 to 2.5.x contain the same code but are only affected when is explicitly set. - is a MIGRATE command owned only by the creator; thus, it remains a reachable trigger even if entity creation is locked down. Remediation Patch Versions: Upgrade to 3.8.7 or 3.8.13 (3.8.13 is the latest fixed version). Fix Details: - Validates the target host for all ThingModel fetches: only local loopback, link-local (covering ), site-local (IPv6 unique local ), multicast, and CIDR block are allowed; additionally blocks loopback, blocked subnets, and blocked regular expressions. - Each redirect target is re-validated before being followed, with a redirect count limit of 5 (default), addressing the uncontrolled recursion issue. - , , and links are resolved via the same domain path and subjected to the same validation. - Validation is enabled by default; configuration options are located under , including corresponding environment variables and Helm values; the allowlist for can be intentionally disabled in deployments. Residual Limitations: Hostname resolution uses a DNS resolver, and sub-request HTTP requests resolve hostnames again; DNS rebinding against hostnames cannot be fully defended against, though literal IP targets are always validated. It is recommended that operators complement with network-layer egress controls. Temporary Mitigations (Workarounds) 1. Apply network-layer egress controls (e.g., Kubernetes NetworkPolicies or firewalls) to prevent the working service from accessing internal address ranges and cloud instance metadata services—recommended as a defense-in-depth measure before upgrading. 2. Restrict entity creation: Use to limit the namespaces in which authenticated subjects can create entities, and enable thing-definition URL validation. 3. Narrow the permission scope in , as definition modification and migration endpoints require it. 4. Disable unused WoT integration: Set . POC / Exploit Code The page includes a configuration example (YAML/JSON style): > Note: This configuration covers the creation path but does not cover the or definition modification endpoints. References CVE: CVE-2026-84175 Fix commit(s) / pull request: #ale704c Related Documentation: Restricting Entity Creation, WoT (Web of Things) Integration, CWE-918 (SSRF), CWE-474 (Uncontrolled Recursion)

Goal Reached Thanks to every supporter — we hit 100%!

Eclipse Ditto CVE-2026-84175: WoT ThingModel URL SSRF via CWE-918

More from this source