HTTP Redirection Vulnerability in Eclipse Ditto Web of Things Service

CVE-2026-84175

What is CVE-2026-84175?

In affected versions of Eclipse Ditto, the Things service inadequately handles HTTP requests made to retrieve Web of Things ThingModels. It fetches these models from user-defined URLs without validating the host and does not enforce a limit on the number of redirects. This oversight allows authenticated users with permissions to create or modify Things to orchestrate arbitrary HTTP GET requests from within the network. This could lead to exposure of sensitive internal services and endpoints by exploiting the varying error messages returned during these unauthorized requests.

References