TI-2026-15089 Aliases CVE-2026-18353

Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

HIGH 77CWE-918Published 2026-07-30 · Updated 2026-07-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix Fixed Eclipse CSI - PIA (Eclipse Foundation): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Eclipse CSI - PIA	0.4.0 to before 0.6.0	0.6.0	Patch available	CNA

Eclipse CSI - PIA VendorEclipse Foundation Affected 0.4.0 to before 0.6.0 Fixed in 0.6.0 Patch available CNA

Remediation

Fix · CNA Eclipse CSI - PIA (Eclipse Foundation) Fixed in 0.6.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-18353

References

Other 1

https://github.com/eclipse-csi/pia/security/advisories/GHSA-v249-9xjm-qhgf

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3

See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences