CVE-2026-7412 - Vulnerability Analysis

Overview

Eclipse BaSyx Java Server SDK < 2.0.0-milestone-10 contains a server-side request forgery caused by failure to validate destination URI in Operation Delegation, letting unauthenticated remote attackers send blind HTTP POST requests to arbitrary targets, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can send arbitrary HTTP POST requests, bypassing network segmentation and pivoting into internal or cloud infrastructure.

Mitigation

Update to version 2.0.0-milestone-10 or later.

References

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/103
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner