CVE-2026-84175 Overview
CVE-2026-84175 is a Server-Side Request Forgery (SSRF) vulnerability in Eclipse Ditto versions 3.0.0 through 3.9.6. The Things service fetches Web of Things (WoT) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature. The service does not validate the target host and follows HTTP redirects without re-validation or a hop limit. Versions 2.4.0 through 2.5.x contain the same code but require the WoT integration feature toggle to be explicitly enabled.
Critical Impact
Authenticated users with permission to create a Thing or WRITE permission on an existing Thing can force the Things service to issue arbitrary HTTP GET requests to internal network endpoints, including cloud instance metadata services.
Affected Products
- Eclipse Ditto 3.0.0 through 3.9.6
- Eclipse Ditto 2.4.0 through 2.5.x (only when the WoT integration feature toggle is enabled)
- Deployments exposing the Things service API to authenticated users
Discovery Timeline
- 2026-09-02 - CVE-2026-84175 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84175
Vulnerability Analysis
The Things service in Eclipse Ditto processes the definition field of Thing and Feature objects as a URL pointing to a WoT ThingModel. When the service resolves this URL, it performs an outbound HTTP GET request without validating the destination host against an allow-list or block-list. The absence of URL validation lets an authenticated caller point the service at arbitrary internal endpoints.
The issue is compounded by unrestricted redirect handling. The HTTP client follows redirects returned by the initial target without re-validating each redirect destination and without enforcing a hop limit. An attacker can host a public URL that redirects to internal-only endpoints such as http://169.254.169.254/ on cloud providers, bypassing any perimeter filtering that only inspects the initial request URL.
The vulnerability aligns with [CWE-674: Uncontrolled Recursion] due to the missing redirect hop limit, and functionally manifests as SSRF. Differential error responses returned to the API caller allow enumeration of internal services, since reachable and unreachable hosts produce distinguishable failure modes.
Root Cause
The root cause is missing input validation on user-supplied URLs combined with an HTTP client configuration that follows redirects blindly. The Things service treats the definition field as a trusted resource locator and delegates fetching to an HTTP client that lacks host allow-listing, private-address filtering, and redirect controls.
Attack Vector
An authenticated user submits a Thing creation or update request containing a crafted definition URL. The URL either directly targets an internal endpoint or points to an attacker-controlled server that responds with an HTTP redirect to an internal resource. The Things service issues the outbound request from within the deployment network, and the caller infers reachability from the returned error semantics.
Code examples are not published for this vulnerability. Refer to the GitHub Security Advisory GHSA-7f3j-xpvm-wwmg for technical details.
Detection Methods for CVE-2026-84175
Indicators of Compromise
- Outbound HTTP GET requests from Things service pods or hosts to RFC 1918 addresses, link-local addresses (169.254.0.0/16), or loopback ranges.
- Requests from the Things service to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal.
- Thing create or update API calls containing definition values pointing to non-standard or internal hostnames.
- Elevated volumes of Thing modifications from a single authenticated principal correlated with anomalous outbound traffic.
Detection Strategies
- Inspect Ditto API audit logs for definition field values and flag URLs resolving to private, link-local, or metadata address space.
- Correlate Things service egress traffic with API request timestamps to identify SSRF probing patterns.
- Alert on any HTTP redirect chains originating from the Things service that terminate at internal IP ranges.
Monitoring Recommendations
- Enable egress logging on the network segment hosting the Things service and forward events to a centralized analytics pipeline.
- Monitor cloud provider metadata service access logs (AWS IMDS, Azure IMDS, GCP metadata server) for requests originating from Ditto workloads.
- Track per-user rates of Thing creation and update operations to surface enumeration attempts.
How to Mitigate CVE-2026-84175
Immediate Actions Required
- Upgrade Eclipse Ditto to a patched release beyond 3.9.6 as identified in the GitHub Security Advisory GHSA-7f3j-xpvm-wwmg.
- For 2.4.x and 2.5.x deployments, disable the WoT integration feature toggle unless it is operationally required.
- Restrict WRITE permissions on Things to trusted principals only, and audit existing permission grants.
- Enforce IMDSv2 with hop-limit 1 on AWS EC2 instances hosting Ditto workloads to blunt metadata exfiltration.
Patch Information
Review the Eclipse GitLab Vulnerability Report #659 and the GitHub Security Advisory GHSA-7f3j-xpvm-wwmg for fixed version identifiers and upgrade guidance.
Workarounds
- Deploy an egress proxy or network policy that denies traffic from the Things service to RFC 1918, link-local, and loopback ranges.
- Configure Kubernetes NetworkPolicy resources to restrict Things service egress to an explicit allow-list of external WoT model registries.
- Temporarily revoke Thing WRITE permissions from non-essential users until patched versions are deployed.
- Front the Things service with a filtering HTTP forward proxy that validates destination hosts and disables automatic redirect following.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.