CVE-2026-82180

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82180", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-08-28T07:21:13.646Z", "datePublished": "2026-09-03T13:20:01.665Z", "dateUpdated": "2026-09-03T13:31:50.910Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-09-03T13:20:01.665Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-295", "description": "CWE-295 Improper certificate validation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-290", "description": "CWE-290 Authentication bypass by spoofing", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Arrowhead", "versions": [{"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authentication field of MqttRequestTemplate) and treats its Subject DN as the authenticated identity. The certificate is decoded with CertificateFactory.generateCertificate() but its signature is never verified and its issuer chain is never validated against any trust store. Authorisation is reduced to two string comparisons on attacker-supplied data: the DN-qualifier must equal \"sy\" or \"op\", and the cloud-name part of the CN must match the server's. Both values are public (the cloud name is in the server's own TLS certificate). An attacker who can publish to the MQTT broker can therefore mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu, dnQualifier=op, send it as the authentication field, and be authenticated as the cloud's system operator with isSysOp == true. This passes the downstream ManagementServiceMqttFilter (request.isSysOp() \u2192 allowed) and gives full management access over MQTT. The HTTP CertificateFilter is not affected \u2014 it reads the certificate from jakarta.servlet.request.X509Certificate, which Tomcat populates only after a successful mTLS handshake against the configured trust store.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the <code>certificate</code> authentication policy, <code>CertificateMqttFilter</code> parses an X.509 certificate that the client sends <strong>inside the MQTT message payload</strong> (the <code>authentication</code> field of <code>MqttRequestTemplate</code>) and treats its Subject DN as the authenticated identity. The certificate is decoded with <code>CertificateFactory.generateCertificate()</code> but <strong>its signature is never verified and its issuer chain is never validated against any trust store</strong>. Authorisation is reduced to two string comparisons on attacker-supplied data: the DN-qualifier must equal <code>\"sy\"</code> or <code>\"op\"</code>, and the cloud-name part of the CN must match the server's. Both values are public (the cloud name is in the server's own TLS certificate). An attacker who can publish to the MQTT broker can therefore mint a self-signed certificate with <code>CN=Sysop.&lt;cloud&gt;.&lt;org&gt;.arrowhead.eu, dnQualifier=op</code>, send it as the <code>authentication</code> field, and be authenticated as the cloud's system operator with <code>isSysOp == true</code>. This passes the downstream <code>ManagementServiceMqttFilter</code> (<code>request.isSysOp()</code> \u2192 allowed) and gives full management access over MQTT. The HTTP <code>CertificateFilter</code> is <strong>not</strong> affected \u2014 it reads the certificate from <code>jakarta.servlet.request.X509Certificate</code>, which Tomcat populates only after a successful mTLS handshake against the configured trust store."}]}], "references": [{"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/812"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Eclipse Foundation Security Team", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-03T13:31:11.099809Z", "id": "CVE-2026-82180", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T13:31:50.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82180", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-03T13:31:11.099809Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T13:31:47.950Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Eclipse Foundation Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Arrowhead", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.2.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/812"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authentication field of MqttRequestTemplate) and treats its Subject DN as the authenticated identity. The certificate is decoded with CertificateFactory.generateCertificate() but its signature is never verified and its issuer chain is never validated against any trust store. Authorisation is reduced to two string comparisons on attacker-supplied data: the DN-qualifier must equal \"sy\" or \"op\", and the cloud-name part of the CN must match the server's. Both values are public (the cloud name is in the server's own TLS certificate). An attacker who can publish to the MQTT broker can therefore mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu, dnQualifier=op, send it as the authentication field, and be authenticated as the cloud's system operator with isSysOp == true. This passes the downstream ManagementServiceMqttFilter (request.isSysOp() \u2192 allowed) and gives full management access over MQTT. The HTTP CertificateFilter is not affected \u2014 it reads the certificate from jakarta.servlet.request.X509Certificate, which Tomcat populates only after a successful mTLS handshake against the configured trust store.", "supportingMedia": [{"type": "text/html", "value": "In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the <code>certificate</code> authentication policy, <code>CertificateMqttFilter</code> parses an X.509 certificate that the client sends <strong>inside the MQTT message payload</strong> (the <code>authentication</code> field of <code>MqttRequestTemplate</code>) and treats its Subject DN as the authenticated identity. The certificate is decoded with <code>CertificateFactory.generateCertificate()</code> but <strong>its signature is never verified and its issuer chain is never validated against any trust store</strong>. Authorisation is reduced to two string comparisons on attacker-supplied data: the DN-qualifier must equal <code>\"sy\"</code> or <code>\"op\"</code>, and the cloud-name part of the CN must match the server's. Both values are public (the cloud name is in the server's own TLS certificate). An attacker who can publish to the MQTT broker can therefore mint a self-signed certificate with <code>CN=Sysop.&lt;cloud&gt;.&lt;org&gt;.arrowhead.eu, dnQualifier=op</code>, send it as the <code>authentication</code> field, and be authenticated as the cloud's system operator with <code>isSysOp == true</code>. This passes the downstream <code>ManagementServiceMqttFilter</code> (<code>request.isSysOp()</code> \u2192 allowed) and gives full management access over MQTT. The HTTP <code>CertificateFilter</code> is <strong>not</strong> affected \u2014 it reads the certificate from <code>jakarta.servlet.request.X509Certificate</code>, which Tomcat populates only after a successful mTLS handshake against the configured trust store.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper certificate validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication bypass by spoofing"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-09-03T13:20:01.665Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82180", "state": "PUBLISHED", "dateUpdated": "2026-09-03T13:31:50.910Z", "dateReserved": "2026-08-28T07:21:13.646Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-09-03T13:20:01.665Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Arrowhead", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "5.2.1", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authentication field of MqttRequestTemplate) and treats its Subject DN as the authenticated identity. The certificate is decoded with CertificateFactory.generateCertificate() but its signature is never verified and its issuer chain is never validated against any trust store. Authorisation is reduced to two string comparisons on attacker-supplied data: the DN-qualifier must equal \"sy\" or \"op\", and the cloud-name part of the CN must match the server's. Both values are public (the cloud name is in the server's own TLS certificate). An attacker who can publish to the MQTT broker can therefore mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu, dnQualifier=op, send it as the authentication field, and be authenticated as the cloud's system operator with isSysOp == true. This passes the downstream ManagementServiceMqttFilter (request.isSysOp() \u2192 allowed) and gives full management access over MQTT. The HTTP CertificateFilter is not affected \u2014 it reads the certificate from jakarta.servlet.request.X509Certificate, which Tomcat populates only after a successful mTLS handshake against the configured trust store."}], "id": "CVE-2026-82180", "lastModified": "2026-09-03T16:41:09.297", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82180", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-03T13:31:11.099809Z", "version": "2.0.3"}}]}, "published": "2026-09-03T14:17:02.110", "references": [{"source": "emo@eclipse.org", "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/812"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-295"}], "source": "emo@eclipse.org", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Eclipse Arrowhead", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "arrowhead", "vendor": "eclipse"}], "created": "2026-09-03T15:32:56.155147+00:00", "updated": "2026-09-03T15:32:56.155240+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$arrowhead"]}