CVE-2026-82958 Code injection in Eclipse Ditto
Attackers can inject JSON structures via unescaped headers in Eclipse Ditto to override access policies, gaining unauthorized control over digital twins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82958?
CVE-2026-82958 is a high-severity code injection vulnerability in Eclipse Ditto, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
Which versions are affected by CVE-2026-82958?
How do I fix CVE-2026-82958?
No fix has been published for CVE-2026-82958 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-82958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82958 exists.
Sources
Also known as GHSA-cgfq-3fv9-5c44.