CVE-2026-16454: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.
This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under normal operation, a device should be restricted strictly to the specific firmware artifacts explicitly assigned to it. However, this flaw enables any authenticated device to bypass this restriction and download any firmware artifact within the same tenant.
This is not an authentication bypass; the requesting device must possess valid credentials for its respective tenant. Instead, the issue stems from a flaw in object-level authorization validation.
A related, lower-severity helper issue exists in the listing software modules artifacts metadata endpoint. This endpoint does not enforce assignment checks, enabling an authenticated device to list and enumerate available firmware artifacts, which can facilitate targeted exfiltration using the main download authorization bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse hawkBit (DDI Controller)to a version that resolves this vulnerability.Fixed in 1.0.3Patch CWE-284 / CWE-862 - Compensating control
Ensure strict object-level authorization validation in the Direct Device Integration (DDI) Controller so authenticated devices can only list/ download firmware artifacts that are explicitly assigned to them (enforce assignment checks at the artifacts metadata endpoint to prevent tenant-isolated firmware exfiltration).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16454?
CVE-2026-16454 has a medium severity score of 4.3.
How do I fix CVE-2026-16454?
To mitigate CVE-2026-16454, upgrade to Eclipse hawkBit version 1.0.4 or later.
What type of vulnerability is CVE-2026-16454?
CVE-2026-16454 is a privilege escalation vulnerability allowing device permission escalation.
Which versions of Eclipse hawkBit are affected by CVE-2026-16454?
Eclipse hawkBit versions 1.0.3 and prior are affected by CVE-2026-16454.
What impact does CVE-2026-16454 have?
CVE-2026-16454 allows tenant-isolated firmware exfiltration due to permission bypasses.