CVE-2026-82958: High severity Eclipse Ditto vulnerability
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:deviceid }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For connections using the (non-default) ImplicitThingCreation mapper, configure the connection so its authorization subjects are permitted to create things only via the entity-creation configuration (do not permit policy creation). This prevents the inline policy override scenario described.
Eclipse Ditto connectivity service (ImplicitThingCreationMessageMapper) entity-creation configuration / authorization subjects scope = thing creation only - Compensating control
Eclipse Ditto deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact; ensure the connection's authorization subjects are limited to thing creation only using entity-creation configuration.
- Compensating control
Avoid using the ImplicitThingCreation mapper with a pre-configured JSON 'thing' template that reflects attacker-controllable inbound message headers (e.g., MQTT 5 user properties, AMQP 1.0 application properties, or Kafka record headers); otherwise an attacker can inject an inline _policy object.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a connectivity connection uses the ImplicitThingCreationMessageMapper with a JSON thing template that reflects a header value controlled by a publishing device. Examples of controllable header sources include MQTT 5 user properties, AMQP 1.0 application properties, and Kafka record headers.
What does an attacker need to exploit it?
The attacker needs the ability to publish a message on an affected connection and control a header value that is inserted into the configured thing template. The injected value must contain a double quote to escape the intended JSON string context and add JSON structure.
What is the impact of successful exploitation?
An attacker can inject an inline _policy object that overrides the administrator-configured policyId for a newly created digital twin. This can give the attacker full read and write access to that twin and may revoke the legitimate owner's access without administrator interaction.
What configuration should be reviewed while remediation is pending?
Review connectivity connections using the ImplicitThingCreationMessageMapper for templates that substitute inbound message headers into JSON string values. Prioritize connections where untrusted publishers can control the referenced MQTT, AMQP, or Kafka header values.