UBUNTU-CVE-2026-7412

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-7412

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7412.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-7412

Upstream

CVE-2026-7412

Published

2026-05-05T16:16:00Z

Modified

2026-05-14T14:57:08.552399Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

References

Affected packages

Ubuntu:16.04:LTS / eclipse

Package

Name: eclipse
Purl: pkg:deb/ubuntu/eclipse@3.8.1-8?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.8.1-8

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse-jdt"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse-pde"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse-platform"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse-platform-data"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "eclipse-rcp"
        },
        {
            "binary_version": "3.8.1-8",
            "binary_name": "libequinox-osgi-java"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7412.json"

Ubuntu:18.04:LTS / eclipse