CVE-2026-101322In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without…
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse BaSyx AAS Web UI. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.31%, higher than 22% of scored CVEs.
Do this next
Free account, 1 product
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.
- CVSS
- 8.3 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
- Weakness (CWE)
- CWE-201
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.31% (percentile 22)
- Assigned by
- eclipse
- NVD analysis
- Deferred
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Eclipse Foundation Eclipse BaSyx AAS Web UI eclipse_foundation:eclipse_basyx_aas_web_ui (from the name) | from v2-241220 before v2-260924 | CNA record |
References
- https://github.com/eclipse-basyx/basyx-aas-web-ui/pull/1557
- https://github.com/eclipse-basyx/basyx-aas-web-ui/releases/tag/v2-260924
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/328
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.