{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84175 exists.","fix":"No fix has been published for CVE-2026-84175 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-84175 is a medium-severity server-side request forgery vulnerability in Eclipse Ditto, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-84175 and fix it if it is affected.\n\nWhat it is: CVE-2026-84175 is a medium-severity server-side request forgery vulnerability in Eclipse Ditto, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84175 exists.\n\nAffected product: Eclipse Ditto. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-84175/ (Markdown: https://insights.sbomify.com/CVE-2026-84175/index.md)","id":"CVE-2026-84175","markdown":"https://insights.sbomify.com/CVE-2026-84175/index.md","name":"CVE-2026-84175","record":{"aliases":["GHSA-7f3j-xpvm-wwmg"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Eclipse Ditto IoT platform","requires_auth":"low_privilege","summary":"Authenticated users can trigger Server-Side Request Forgery in Eclipse Ditto to access internal network resources and enumerate services via unvalidated WoT model URLs.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"eclipse","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-674","name":"Uncontrolled Recursion"}],"description":"In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Server-side request forgery in Eclipse Ditto","id":"CVE-2026-84175","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection","id":"CVE-2026-84176"},"packages":[],"prev":{"headline":"Missing authorization in Eclipse Ankaios","id":"CVE-2026-84173"},"products":["Eclipse Ditto"],"published":"2026-09-02","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-02","vendors":["Eclipse Foundation"]},"summary":"Authenticated users can trigger Server-Side Request Forgery in Eclipse Ditto to access internal network resources and enumerate services via unvalidated WoT model URLs.","url":"https://insights.sbomify.com/CVE-2026-84175/"}