CVE-2026-107597Medium· 5.1▾ SunlitPIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the appr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (pia/oidc.py:42-52). An approved identity provider — and every registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc is a separate such party (pia/models.py) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated POST /v1/upload/sbom request that is ultimately rejected with 401.
eclipse_csi_-_pia <= 0.8.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108062Medium· 6.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
CVE-2026-18660High· 8.8In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVE-2026-86671High· 8.4In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host a…
CVE-2026-102722Medium· 6.9In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply
CVE-2026-114278Critical· 9.8Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
CVE-2026-115408Medium· 5.5ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets