GHSA-gx3v-wxfj-8h24

Source

https://github.com/advisories/GHSA-gx3v-wxfj-8h24

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gx3v-wxfj-8h24/GHSA-gx3v-wxfj-8h24.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gx3v-wxfj-8h24

Aliases

CVE-2026-7412

Published

2026-05-05T18:33:26Z

Modified

2026-05-11T16:41:32Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

Details

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-11T16:23:04Z",
    "nvd_published_at":  "2026-05-05T16:16:18Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.eclipse.basyx:basyx.sdk

Package

Name: org.eclipse.basyx:basyx.sdk; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.basyx/basyx.sdk

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.0-milestone-10

Affected versions

1.*

1.0.1

1.0.2

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0

1.5.0

1.5.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gx3v-wxfj-8h24/GHSA-gx3v-wxfj-8h24.json"