CVE-2026-82958: Eclipse Ditto XSS Vulnerability

CVE-2026-82958 Overview

CVE-2026-82958 is a JSON injection vulnerability in Eclipse Ditto versions 1.3.0 through 3.9.6. The ImplicitThingCreationMessageMapper in the connectivity service substitutes placeholder values from inbound message headers into a JSON thing template without escaping. An attacker who controls a reflected header value can break out of the JSON string context and inject an inline _policy object. This override replaces the administrator-configured policyId, granting the attacker arbitrary access-control over the newly created digital twin. The flaw is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Attackers can hijack digital twin access policies at creation time, gaining full read/write control and potentially locking out the legitimate owner without any administrator interaction.

Affected Products

Eclipse Ditto 1.3.0 through 3.9.6
Deployments using the non-default ImplicitThingCreation message mapper
Connections whose templates reflect attacker-controllable headers (MQTT 5 user properties, AMQP 1.0 application properties, Kafka record headers)

Discovery Timeline

2026-09-02 - CVE-2026-82958 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82958

Vulnerability Analysis

Eclipse Ditto is an open-source framework for building digital twins of IoT devices. The connectivity service ingests messages from external brokers and can automatically create things via the ImplicitThingCreationMessageMapper. This mapper accepts a JSON template containing placeholders such as {{ header:device_id }} that resolve against inbound message headers.

The placeholder engine performs raw string substitution. It has no awareness of the surrounding JSON string context and applies no JSON escaping. When a resolved header value contains a double-quote character, the value terminates its enclosing JSON string early. The remainder of the header content is then parsed as additional JSON structure by Ditto's downstream parser.

Attackers exploit this by injecting an inline _policy object into the resulting CreateThing command. Ditto processes the inline policy as authoritative, overriding the policyId the administrator configured. The attacker chooses the subjects and permissions on the new twin, gaining full read and write access and optionally excluding the intended owner.

Root Cause

The root cause is string-based JSON construction without contextual output encoding. The mapper concatenates un-escaped user-controlled data into a JSON template before parsing, violating the separation between code (JSON structure) and data (header values).

Attack Vector

Exploitation requires three conditions: the connection uses the ImplicitThingCreation mapper; the template reflects an attacker-controllable header; and the connection's authorization subjects can create policies, which is the default. The attacker publishes a message on the connection with a crafted header value containing a double-quote followed by an inline _policy JSON fragment. When the mapper substitutes the header into the template and parses the result, Ditto creates the thing with the attacker-supplied policy. Deployments that use the entity-creation configuration to restrict connection subjects to thing creation only are not affected by the policy-override impact. Refer to the Eclipse Ditto GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-82958

Indicators of Compromise

CreateThing audit events where the resulting twin's policyId differs from the connection's configured default policy
Inbound MQTT 5, AMQP 1.0, or Kafka messages carrying header values containing embedded double-quote characters followed by JSON tokens such as _policy, entries, or subjects
Newly created things whose access policies grant subjects not present in the connection's authorization context
Sudden loss of owner access to existing digital twins immediately after a CreateThing operation

Detection Strategies

Inspect Ditto connectivity service logs for parsed CreateThing commands containing inline _policy objects originating from mapper output
Enable payload logging on connections using ImplicitThingCreation and alert on header values containing " or JSON meta-characters
Diff the effective policy of newly created twins against the connection's configured policyId template

Monitoring Recommendations

Forward Ditto audit logs and connectivity service telemetry to a centralized logging pipeline for correlation
Alert on policy mutations that occur within the same transaction as thing creation from a connectivity source
Track authorization-subject drift on twins created through implicit mappers

How to Mitigate CVE-2026-82958

Immediate Actions Required

Upgrade Eclipse Ditto to a version above 3.9.6 that includes the fix referenced in the GitHub Security Advisory GHSA-cgfq-3fv9-5c44
Audit all connections using the ImplicitThingCreation mapper and identify templates that reflect device-controlled headers
Review recently created things for unexpected policyId values or unauthorized policy entries

Patch Information

Eclipse Ditto has published a security advisory addressing this issue. Consult the GitHub Security Advisory and the GitLab Vulnerability Report #764 for fixed version details and upgrade guidance.

Workarounds

Restrict the connection's authorization subjects using the entity-creation configuration to permit thing creation only, preventing the policy-override impact
Remove or replace ImplicitThingCreation mappers whose templates reflect attacker-controllable headers
Validate and sanitize inbound header values at the broker or ingress layer to reject double-quote characters and JSON metacharacters before they reach Ditto

bash

# Configuration example: restrict connection subjects to thing creation only
# Refer to the Eclipse Ditto entity-creation configuration documentation
# for the exact syntax matching your deployment version.