Read the docs
TI-2026-13749 Aliases CVE-2026-16454GHSA-92r3-p8c2-3fpxGHSA-f3j8-8ggq-f9x2

Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

Priority LOW 20CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant. This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation. A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed eclipse-hawkbit/hawkbit (Eclipse Foundation): 1.0.4org.eclipse.hawkbit:hawkbit-ddi-resource (Maven): 1.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationeclipse-hawkbit/hawkbitup to 1.0.31.0.4Patch availableCNA
—org.eclipse.hawkbit:hawkbit-ddi-resource (Maven)before 1.0.41.0.4Patch availableGHSA-92r3-p8c2-3fpx
  • eclipse-hawkbit/hawkbit VendorEclipse Foundation Affected up to 1.0.3 Fixed in 1.0.4 Patch available CNA
  • org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-92r3-p8c2-3fpx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:*before 1.0.4VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:hawkbit:*:*:*:*:*:*:*:* Versions before 1.0.4 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA eclipse-hawkbit/hawkbit (Eclipse Foundation) Fixed in 1.0.4
  • Fix · GHSA-92r3-p8c2-3fpx org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) Fixed in 1.0.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16454
  2. 2026-10-03 Alias added: GHSA-f3j8-8ggq-f9x2
  3. 2026-11-06 Alias added: GHSA-92r3-p8c2-3fpx
  4. 2026-11-06 Fix available: Maven/org.eclipse.hawkbit:[email protected] · GHSA-92r3-p8c2-3fpx
  5. 2026-11-06 CVSS score added · GHSA-92r3-p8c2-3fpx
  6. 2026-11-06 Weakness changed · GHSA-92r3-p8c2-3fpx
  7. 2026-11-06 9 new references · GHSA-92r3-p8c2-3fpx

References

Advisory 2

Other 7

  • TI-2019-07555 Cleartext transmission of sensitive information in Eclipse hawkBit CVSS 3.1HIGH 8.1
  • TI-2020-16545 Cross-site scripting in Eclipse Hawkbit CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences