CVE-2026-7412 Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
Unauthenticated attackers can force the BaSyx server to send blind HTTP POST requests to arbitrary internal or external targets, bypassing network segmentation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7412?
CVE-2026-7412 is a high-severity server-side request forgery vulnerability in Eclipse BaSyx, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
Weakness: CWE-918
Which versions are affected by CVE-2026-7412?
2 open source packages ship an affected version, including org.eclipse.basyx:basyx.sdk.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.basyx:basyx.sdk Maven | All versions | 2.0.0-milestone-10 |
org.eclipse.basyx:basyx.sdk Maven | All versions | 2.0.0-milestone-10 |
How do I fix CVE-2026-7412?
Upgrade org.eclipse.basyx:basyx.sdk to 2.0.0-milestone-10 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-7412 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7412 exists.
Sources
Also known as GHSA-gx3v-wxfj-8h24, UBUNTU-CVE-2026-7412.