{"id":"CVE-2026-82958","state":"PUBLISHED","title":"In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {","description":"In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON \"thing\" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.\n\n\n\n\nWhen a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.\n\n\n\n\nExploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.","publishedAt":"2026-09-02T10:12:49.085Z","updatedAt":"2026-09-02T12:53:05.342Z","severity":{"score":7.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"eclipse"},"assigner":"eclipse","products":["Eclipse Foundation Eclipse Ditto"],"affected":[{"vendor":"Eclipse Foundation","product":"Eclipse Ditto","defaultStatus":"unaffected","versions":[{"version":"1.3.0","status":"affected","lessThanOrEqual":"3.9.6","versionType":"semver"}]}],"references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/764","https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-cgfq-3fv9-5c44"],"weaknesses":["CWE-1336","CWE-116","CWE-74"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82958.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82958","state":"PUBLISHED","datePublished":"2026-09-02T10:12:49.085Z","dateUpdated":"2026-09-02T12:53:05.342Z","assignerShortName":"eclipse","assignerOrgId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","dateReserved":"2026-08-31T12:47:29.479Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON \"thing\" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.\n\n\n\n\nWhen a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.\n\n\n\n\nExploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact."}],"affected":[{"vendor":"Eclipse Foundation","product":"Eclipse Ditto","defaultStatus":"unaffected","versions":[{"version":"1.3.0","status":"affected","lessThanOrEqual":"3.9.6","versionType":"semver"}]}],"references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/764"},{"url":"https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-cgfq-3fv9-5c44"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1336","lang":"en","description":"CWE-1336 Improper neutralization of special elements used in a template engine","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-116","lang":"en","description":"CWE-116 Improper Encoding or Escaping of Output","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-74","lang":"en","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"eclipse","orgId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","dateUpdated":"2026-09-02T10:12:49.085Z"},"impacts":[{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137 Parameter Injection"}]},{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"credits":[{"lang":"en","value":"Mohamed Lemine Ahmed Jidou","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/764","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-02T12:52:37.950498Z","id":"CVE-2026-82958","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-02T12:53:05.342Z"}}]}}}