Catálogo de CVE
CVE-2026-7412
UBUNTU-
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
- Gravidade
- Desconhecido
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.52% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Ubuntu18.04 | eclipse | 3.8.1-10 | Affected | [UBUNTU-CVE-2026-7412] |
| Ubuntu18.04 | eclipse | 3.8.1-11 | Affected | [UBUNTU-CVE-2026-7412] |
| Ubuntu16.04 | eclipse | 3.8.1-8 | Affected | [UBUNTU-CVE-2026-7412] |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Ubuntu16.04 | eclipse | 3.8.1-8 | Affected | [UBUNTU-CVE-2026-7412] |
| Ubuntu18.04 | eclipse | 3.8.1-10 | Affected | [UBUNTU-CVE-2026-7412] |
| Ubuntu18.04 | eclipse | 3.8.1-11 | Affected | [UBUNTU-CVE-2026-7412] |
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "eclipse",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "16.04",
"versions": [
"3.8.1-8"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-7412",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2026-7412",
"provider_updated_at": "2026-05-14T14:57:08.552399Z"
},
{
"name": "eclipse",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"3.8.1-10",
"3.8.1-11"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-7412",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2026-7412",
"provider_updated_at": "2026-05-14T14:57:08.552399Z"
}
]
}OpenFactory catalog packages
A associação de pacotes está em andamento.
Observado: