Read the docs
TI-2026-57893 Aliases CVE-2026-84197GHSA-j7r5-6vmc-cmcc

Improper certificate validation in Eclipse Ditto

Priority MEDIUM 42CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed Eclipse Ditto (Eclipse Foundation): 3.8.1, 3.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Ditto2.0.0 to before 3.8.1; 3.9.0 to before 3.9.13.8.1, 3.9.1Patch availableCNA
Eclipse FoundationEclipse Ditto1.0.0 – 2.1.0—No fix listedCNA
  • Eclipse Ditto VendorEclipse Foundation Affected 2.0.0 to before 3.8.1; 3.9.0 to before 3.9.1 Fixed in 3.8.1, 3.9.1 Patch available CNA
  • Eclipse Ditto VendorEclipse Foundation Affected 1.0.0 – 2.1.0 Fixed in — No fix listed CNA

Remediation

  • Fix · CNA Eclipse Ditto (Eclipse Foundation) Fixed in 3.8.1, 3.9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84197
  2. 2026-10-03 Alias added: GHSA-j7r5-6vmc-cmcc

References

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences