CVE-2026-18353: PIA OIDC SSRF Vulnerability

CVE-2026-18353 Overview

CVE-2026-18353 is a Server-Side Request Forgery (SSRF) vulnerability in Eclipse PIA's POST /v1/upload/sbom endpoint. The endpoint validates the iss claim of an incoming Bearer JWT against an issuer allowlist using Python's urlparse, then performs OpenID Connect (OIDC) discovery with the requests library. A parser differential between urlparse and requests/urllib3 allows attackers to bypass the allowlist and drive outbound HTTP connections to arbitrary hosts. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated attacker can coerce the PIA server into issuing requests to attacker-controlled hosts, ports, and schemes, enabling internal network reconnaissance and potential interaction with internal services.

Affected Products

Eclipse PIA (Public Interest Attestation) service
Deployments exposing the POST /v1/upload/sbom endpoint
Instances relying on JWT iss-based issuer allowlisting for OIDC discovery

Discovery Timeline

2026-07-30 - CVE-2026-18353 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18353

Vulnerability Analysis

The POST /v1/upload/sbom endpoint in Eclipse PIA accepts a Bearer JWT in the Authorization header. Before verifying the token's signature, the service extracts the unverified iss claim and checks its hostname against an allowlist of trusted issuers. The service uses Python's standard library urlparse to extract the authority component from the iss URL.

After passing the allowlist check, PIA uses the requests library to perform OIDC discovery against the same iss URL. It fetches the /.well-known/openid-configuration document, then retrieves the JSON Web Key Set (JWKS) via urllib.request.urlopen using URLs returned by the discovery document. The JWKS is used to verify the JWT signature.

The vulnerability arises because urlparse and requests/urllib3 disagree on how to parse URLs whose authority contains a backslash character. This parser differential produces two different host interpretations from a single string.

Root Cause

Given an issuer such as https://attacker-host\@ci.eclipse.org/, Python's urlparse interprets the authority as ci.eclipse.org because it treats the backslash as part of userinfo. In contrast, requests and urllib3 interpret the same authority as attacker-host, treating \@ci.eclipse.org as a path or applying different escaping rules. The allowlist check therefore passes against the legitimate ci.eclipse.org hostname, while the subsequent HTTP request connects to attacker-host.

The underlying weakness is trust in an unverified JWT claim to select an OIDC issuer, combined with an inconsistency between URL parsers used for security decisions and outbound connections.

Attack Vector

An unauthenticated remote attacker crafts a JWT whose iss claim contains a backslash-separated authority. The attacker sends the token to POST /v1/upload/sbom as a Bearer credential. PIA's allowlist check accepts the token because urlparse returns an allowlisted hostname. PIA then issues an HTTP GET to the attacker-controlled host for the OIDC discovery document, and follows the jwks_uri returned by that document to any host, port, and scheme the attacker chooses. This grants the attacker an SSRF primitive originating from the PIA server.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-v249-9xjm-qhgf for full technical details.

Detection Methods for CVE-2026-18353

Indicators of Compromise

Requests to POST /v1/upload/sbom bearing JWTs whose iss claim contains backslash (\), percent-encoded backslash (%5C), or embedded @ characters in the authority component
Outbound HTTP or HTTPS connections from the PIA host to destinations not present in the configured issuer allowlist
OIDC discovery requests (/.well-known/openid-configuration) originating from PIA to unexpected external hosts or non-standard ports

Detection Strategies

Log the raw iss claim from every JWT presented to /v1/upload/sbom and alert on non-ASCII, encoded, or backslash characters in the authority
Compare the hostname resolved by urlparse with the hostname resolved by the HTTP client for each incoming token, flagging any mismatch
Correlate inbound /v1/upload/sbom requests with outbound network flows from the PIA host to identify unexpected destinations

Monitoring Recommendations

Enable egress logging on the PIA workload and baseline expected OIDC issuer endpoints
Forward web application and DNS resolver logs from PIA hosts into a centralized analytics pipeline for correlation
Alert on connections from PIA to RFC1918, link-local, or cloud metadata addresses (e.g., 169.254.169.254)

How to Mitigate CVE-2026-18353

Immediate Actions Required

Upgrade Eclipse PIA to the patched release referenced in GHSA-v249-9xjm-qhgf
Restrict egress from PIA hosts to only the exact hostnames and ports of legitimate OIDC issuers
Audit application logs for prior requests to /v1/upload/sbom containing malformed iss claims

Patch Information

Refer to the Eclipse PIA GitHub Security Advisory for the fixed version and upgrade instructions. The remediation aligns the parser used for allowlist validation with the parser used for outbound HTTP requests, rejecting authorities that contain ambiguous or non-conforming characters.

Workarounds

Place PIA behind a reverse proxy or WAF rule that rejects Bearer tokens whose decoded iss claim contains backslash or %5C sequences
Enforce an egress allowlist at the network layer that restricts PIA to the exact IP addresses of trusted OIDC issuers
Disable the /v1/upload/sbom endpoint until the patch is applied if it is not required for operations

bash

# Example egress restriction using iptables to permit only trusted OIDC issuers
iptables -A OUTPUT -o eth0 -p tcp -d ci.eclipse.org --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -o eth0 -p tcp --dport 80  -j REJECT