p PatchFirst

CVE-2026-7412

CVE-2026-7412

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

CVSS 8.6 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse basyx

    Versions
    • ≥ 0, < 2.0.0-milestone-10: Affected (custom)

    Update to 2.0.0-milestone-10

  • eclipse Ubuntu:16.04:LTS

    Versions
    • 3.8.1-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • eclipse Ubuntu:18.04:LTS

    Versions
    • 3.8.1-10
    • 3.8.1-11
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →