CVE-2026-14304 Overview
CVE-2026-14304 is an XML External Entity (XXE) vulnerability in the Eclipse Accessibility Tools Framework (ACTF). The flaw affects ACTF versions up to 1.6.0, source code versions up to v20260630, and ACTF-based applications such as miChecker versions up to 3.1.0. The vulnerability is tracked under CWE-611: Improper Restriction of XML External Entity Reference. A malicious third party can craft XML input that, when processed by an affected application, discloses local files or reaches internal network resources from the host running the application.
Critical Impact
An attacker can leverage crafted XML content to read local resources or pivot to internal network endpoints via systems running Eclipse ACTF or miChecker.
Affected Products
- Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0
- Eclipse ACTF source code versions up to v20260630
- ACTF-based application miChecker versions up to 3.1.0
Discovery Timeline
- 2026-08-05 - CVE-2026-14304 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-14304
Vulnerability Analysis
The vulnerability resides in XML parsing routines used by Eclipse ACTF and applications built on the framework, including the miChecker accessibility validation tool. When these components parse XML documents, the underlying parser resolves external entity declarations without adequate restrictions. An attacker who supplies XML input containing external entity references can force the parser to fetch content from arbitrary URIs.
Exploitation requires local access and user interaction, since the affected tools typically process XML files opened by a user. Despite this constraint, a successful attack allows the parser to read files from the local file system or issue outbound requests to hosts reachable from the workstation. This can expose configuration files, credentials stored in text, or accessibility content that references internal-only resources.
Root Cause
The root cause is missing hardening on the XML parser used by ACTF components. XML processors resolve <!ENTITY> declarations, including SYSTEM identifiers pointing to file:// or http:// URIs, unless explicitly disabled. ACTF versions up to 1.6.0 do not disable DOCTYPE, external general entities, or external parameter entities before invoking the parser, satisfying the conditions of CWE-611.
Attack Vector
An attacker delivers a malicious XML document to a user of miChecker or another ACTF-based tool. When the user opens or validates the document, the parser resolves attacker-controlled entities. The parser then reads files such as /etc/passwd, Windows user profile artifacts, or reaches internal HTTP services. Because the request originates from the user's workstation, the attacker can probe internal networks that are otherwise not reachable from the internet.
No verified public exploit code is available. Technical details are described in prose per the Eclipse miChecker vulnerability advisory and the GitLab CVE assignment work item.
Detection Methods for CVE-2026-14304
Indicators of Compromise
- Outbound network connections initiated by Eclipse or miChecker processes toward unexpected internal or external hosts during or immediately after XML file processing.
- Access to sensitive local files such as /etc/passwd, C:\Windows\win.ini, or user credential stores by the Java process hosting ACTF.
- XML files on user systems containing <!DOCTYPE> declarations with SYSTEM external entity references pointing to file:// or http:// URIs.
Detection Strategies
- Inspect XML content processed by miChecker and ACTF-based applications for DOCTYPE declarations and external entity references.
- Correlate Java or Eclipse process telemetry with file-read events on sensitive paths and outbound network calls made during XML validation workflows.
- Alert on ACTF or miChecker binaries initiating connections to internal management interfaces or metadata endpoints.
Monitoring Recommendations
- Log endpoint file-open and network-connect events for Java processes hosting Eclipse ACTF plug-ins and forward them to a central analytics platform.
- Track user workflows that involve accessibility validation of externally sourced HTML or XML content and flag documents containing entity declarations.
- Review egress firewall logs for connections from workstations to internal services that should not be reached from user endpoints.
How to Mitigate CVE-2026-14304
Immediate Actions Required
- Restrict use of miChecker 3.1.0 and earlier, and Eclipse ACTF 1.6.0 and earlier, to trusted XML input only until an updated release is applied.
- Only open accessibility validation targets from trusted sources; block validation of XML documents received from untrusted senders.
- Segment workstations running ACTF-based tools so they cannot reach sensitive internal services during validation activities.
Patch Information
Refer to the Eclipse miChecker vulnerability page and the Eclipse ACTF GitHub repository for the current fixed versions and upgrade guidance. Apply the vendor-supplied update as soon as it is available in your environment.
Workarounds
- Avoid processing XML documents received from untrusted sources with any ACTF-based tool until patched.
- Where feasible, run ACTF-based tools inside a restricted account or sandbox that cannot read sensitive files or reach internal networks.
- Enforce egress filtering on endpoints so that Java processes hosting ACTF plug-ins cannot connect to arbitrary external or internal hosts.
# Configuration example: restrict egress for the Eclipse process on Linux
# using iptables owner match (adjust UID for the account running Eclipse/miChecker)
sudo iptables -A OUTPUT -m owner --uid-owner eclipseuser -d 10.0.0.0/8 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner eclipseuser -d 192.168.0.0/16 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner eclipseuser -d 172.16.0.0/12 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
