High severity · published May 5, 2026
CVE-2026-7412
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests
8.6
CVSS
0.5%
EPSS
No
On KEV
Description
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EB
Eclipse BaSyx · Eclipse Foundation
before 2.0.0-milestone-10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7412
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/issues/103
gitlab.eclipse.org
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423
More from Eclipse BaSyx
10.0
CVE-2026-7411
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform…