Vulnerability Intelligence Report
CVE-2026-7412
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).
No Active Exploit Signals
CVSS Base Score
8.6
HIGH
Exploitability:3.9
Impact Score:4.0
EPSS Probability:0.52%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-918 ↗CWE-918 Server-Side request forgery (SSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Eclipse Foundation | Eclipse BaSyx | 0 < 2.0.0-milestone-10 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.516%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Eclipse Foundation · Vendor · Belgium |
| Reserved | 2026-04-29T13:23:24 |
| Published | 2026-05-05T14:15:05 |
| Last Updated | 2026-05-06T15:25:44 |
Community Chatter & Buzz