What’s Vulnerable › Vulnerabilities

CVE-2026-7412

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-05 · updated 2026-07-24
• Weakness: CWE-918

Description

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets. This allows an attacker to bypass network segmentation and pivot into isolated internal IT/OT infrastructure or target Cloud Metadata services (IMDS).

Affected products

• Eclipse Foundation Eclipse BaSyx: before 2.0.0-milestone-10 — fixed in 2.0.0-milestone-10

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse BaSyx 2.0.0-milestone-10. Check the vendor advisory for mitigations.

References

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/103
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423

Get alerted when CVE-2026-7412 or the next vulnerability affects your stack