Eclipse Ditto JSON Template Injection Causing Policy Bypass (CVE-2026-82958)

Summary of Key Vulnerability Information Vulnerability Overview Title: JSON Template Injection in in Eclipse Ditto Allows Policy Bypass CVE: CVE-2026-82958 Severity: High (CVSS v3.1 Score 7.6/10) Affected Component: Vulnerability Type: JSON Template Injection (CWE-136). An attacker can inject placeholder values (e.g., ) in message headers, causing JSON templates to be resolved as unescaped JSON, thereby overriding the configured by an administrator to achieve policy hijacking. Scope of Impact Affected Versions: (specifically ranging from up to , i.e., versions 1.3.0 through 3.9.6) Fixed Versions: or Affected Deployments: Deployments using the default (non-default) payload mapper with anonymous access enabled; attackers can create entities (such as gateways/sensors) and inject custom policies, thereby gaining full access privileges. Not Affected: Deployments that only reflect headers from trusted middleware (where originates from device authentication) or deployments not using this mapper. Remediation 1. Version Upgrade: Upgrade to the fixed version 3.9.7 or 3.8.13 (Fix Commit: ). 2. Mitigations (if not upgrading): - Restrict Entity Creation: Configure ( ) so that the connecting subject is only authorized to create entities and is not allowed to create entities. Process inline as a separate command, rather than injecting it via . - Do Not Reflect Device-Controlled Headers: Ensure the template only substitutes header values originating from trusted middleware (such as gateway/identity layer), which are tamper-proof by the device. PoC / Exploitation Code The page does not contain a standalone PoC code block, but the description provides an injection example: This placeholder is resolved as unescaped JSON in the message header, allowing it to override the to achieve policy bypass.

Goal Reached Thanks to every supporter — we hit 100%!

Eclipse Ditto JSON Template Injection Causing Policy Bypass (CVE-2026-82958)

More from this source