CVE-2026-10055: SSRF
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller.
Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary.
The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict access to the Theia service connection so that only trusted users/clients can reach the standard /services messaging endpoint and invoke /services/request-service, because the backend accepts attacker-controlled URLs and performs server-side HTTP requests.
Eclipse Theia /services/request-service RPC (server-side URL fetching) = Allow only validated/allowlisted destination URLs; reject attacker-controlled URLs from untrusted clients
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10055?
The severity of CVE-2026-10055 is high with a score of 8.5.
What is CVE-2026-10055?
CVE-2026-10055 is a vulnerability in Eclipse Theia that allows an attacker to send a controlled URL to a backend service, leading to potential server-side request forgery (SSRF) and information leakage.
How do I fix CVE-2026-10055?
To fix CVE-2026-10055, update to the latest version of Eclipse Theia where the issue has been addressed.
What are the potential impacts of CVE-2026-10055?
The potential impacts of CVE-2026-10055 include unauthorized access to sensitive data through server-side request forgery.
Which versions of Eclipse Theia are affected by CVE-2026-10055?
CVE-2026-10055 affects Eclipse Theia versions from 1.26.0 onwards.