Remote Code Execution Vulnerability in Eclipse Theia by Eclipse Foundation

CVE-2026-10055

What is CVE-2026-10055?

Eclipse Theia versions since 1.26.0 contain a vulnerability in the backend /services/request-service that allows attacker-controlled URLs to be processed. This enables remote attackers, who can connect to Theia's service, to execute server-side HTTP requests to localhost or other services reachable from the server. Since the URL input is neither validated nor allowlisted, sensitive information, including internal administrative endpoints and cloud instance metadata, can be exposed. Vulnerable deployments include those where Theia's service endpoints are accessible to untrusted users, such as in multi-tenant or publicly-accessible environments.

References