CVE-2026-84175 in Ditto
Summary
by MITRE • 09/02/2026
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Eclipse Ditto versions ranging from 3.0.0 through 3.9.6 represents a critical server-side request forgery flaw rooted in insufficient input validation and unsafe HTTP client configuration within the Things service component. This security defect specifically affects the mechanism by which the system retrieves Web of Things ThingModels, allowing authenticated users with CREATE permissions for new Things or WRITE permissions on existing ones to manipulate the source URLs provided during resource definition. The core technical failure lies in the absence of host validation when fetching these models over HTTP and the lack of restrictions on redirect handling. When a user supplies a URL pointing to an internal service address, such as cloud instance-metadata endpoints like 169.254.169.254 or other private network resources, the application blindly executes the request from its own context without verifying that the target host is authorized for external access.
The operational impact of this vulnerability extends beyond simple data exfiltration to include comprehensive internal service enumeration and potential compromise of sensitive infrastructure metadata. By leveraging HTTP redirects, an attacker can chain multiple requests where each step bypasses validation checks because the system does not re-validate the redirect target against a whitelist nor enforce a hop limit to prevent infinite loops or complex routing attacks. This behavior enables the retrieval of highly sensitive information stored in instance-metadata services, which often contain authentication tokens, configuration details, and other credentials essential for maintaining cloud infrastructure integrity. Furthermore, the differing error responses returned by various internal services allow attackers to perform network reconnaissance, effectively mapping out the internal topology and identifying live hosts based on response codes or timeout behaviors, thereby facilitating further targeted attacks against specific backend components.
This issue is classified under CWE-918 as Server-Side Request Forgery (SSRF) due to the ability of an authenticated user to induce the server to make requests to arbitrary destinations. In terms of offensive security frameworks, this vulnerability aligns with MITRE ATT&CK technique T1504.003, which involves Web of Things protocols being used for lateral movement or data exfiltration within IoT ecosystems. The exploitation vector relies on authenticated access, meaning that robust identity and access management controls are the primary defense layer before technical mitigations can be fully effective. For organizations running Eclipse Ditto versions 2.4.0 to 2.5.x, the risk is conditional upon the explicit enabling of the WoT integration feature toggle; since this feature is disabled by default in those legacy releases, these specific version ranges remain unaffected unless manually configured otherwise.
To mitigate this vulnerability, operators must immediately upgrade to a patched version of Eclipse Ditto that implements strict URL validation and restricts HTTP client behavior regarding redirects. Security best practices dictate the implementation of an allowlist for permitted hostnames or IP addresses when fetching external resources, ensuring that only pre-approved domains can be accessed by the Things service. Additionally, configuring the underlying HTTP client to disable automatic redirect following or enforcing a maximum hop count prevents attackers from chaining requests to bypass initial validation checks. Network-level controls such as egress filtering should also be deployed to restrict outbound connections from application servers to sensitive internal subnets and cloud metadata endpoints, providing a defense-in-depth strategy that limits the blast radius even if an attacker successfully exploits this SSRF condition within the application layer.