Pre-authentication Design Flaw in Eclipse CSI Products

CVE-2026-108062

What is CVE-2026-108062?

Eclipse CSI products are affected by a design flaw where pre-authentication OpenID Connect (OIDC) discovery and JSON Web Key Set (JWKS) fetch operations are processed synchronously on the asyncio event loop. This implementation flaw leads to a situation where a single unauthenticated request can stall the entire service, potentially disrupting operations and impacting availability.

References