Vulnerability database

5 results

• Oct 20, 2026Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.CVE-2026-108062 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9

  Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

  Product

  Eclipse CSI - PIA

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordgithub.comgitlab.eclipse.org

• Oct 20, 2026PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` containeCVE-2026-107597 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.1

  PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

  Product

  Eclipse CSI - PIA

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordgithub.comgitlab.eclipse.org

• Jul 30, 2026PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` beforCVE-2026-18353 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8

  PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.

  Product

  Eclipse CSI - PIA

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordgithub.comgithub.com

• Jul 2, 2026PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:CVE-2026-14336 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2

  PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check while pointing the OIDC discovery and JWKS fetches at a server the attacker controls. An unauthenticated caller of POST /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen host, and to have oidc.verify_token accept a JWT signed with the attacker's own key.

  Product

  Eclipse CSI - PIA

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordgitlab.eclipse.org

• Jun 29, 2026The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into threCVE-2026-12616 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9

  The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation gate. Because the configured log format ("%(asctime)s - %(name)s - %(levelname)s - %(message)s") renders newlines literally, an unauthenticated attacker can forge log records that are byte-for-byte indistinguishable from PIA's genuine "Successfully authenticated project" message. PIA is an authentication broker whose logs are explicitly relied upon for incident response (DESIGN.md §5.4 lists "Token verifications" and "Errors" as events to log), so the ability to plant fake auth-success entries directly undermines the audit trail the service exists to produce.

  Product

  Eclipse CSI - PIA

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordgitlab.eclipse.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.