PT-2026-37080 · Eclipse Foundation · Eclipse Basyx Java Server Sdk

Mohamed Lemine Ahmed Jidou · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-7412

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10

Description The Operation Delegation feature fails to validate the destination URI of delegated requests. This design flaw allows an unauthenticated remote attacker to force the server to execute blind HTTP POST requests to arbitrary internal or external targets. Consequently, an attacker can bypass network segmentation to pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

Recommendations Update to version 2.0.0-milestone-10 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7412

GHSA-GX3V-WXFJ-8H24

Affected Products

Eclipse Basyx Java Server Sdk

References · 10

• 🔥 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7412 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7412 · Security Note
• https://osv.dev/vulnerability/GHSA-gx3v-wxfj-8h24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7412 · Security Note
• https://ubuntu.com/security/CVE-2026-7412 · Vendor Advisory
• https://github.com/eclipse-basyx/basyx-java-sdk · Note
• https://reddit.com/r/AZURE/comments/1taoajk/eclipse_basyx_cve20267411_cve20267412_cvss_100 · Reddit Post
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/103 · Note
• https://t.me/CVEtracker/52763 · Telegram Post