Eclipse BaSyx AAS Web UI: Credential leak to untrusted request destinations
Summary
The Web UI attached the configured infrastructure's Authorization header to outgoing requests without checking the destination. In deployments that use authentication, an attacker can make a logged-in user open a crafted link whose aas or path parameter points to an attacker-controlled endpoint. The browser then sends Basic Auth credentials, a Bearer token or an OAuth2 access token to that endpoint, and the attacker can reuse them to access protected AAS services with the victim's privileges.
Affected
- Eclipse BaSyx AAS Web UI v2-241220 up to, but not including, v2-260924 (CNA record)
- Only deployments with authentication configured are affected
- The OSV entry also lists an introduced range starting at 0; this conflicts with the CNA record and is not verified
Fixed in
- Upgrade to v2-260924 or later
Workaround
Unknown. No vendor-published workaround.
Interim measures until the upgrade: do not open Web UI links from untrusted sources and limit the privileges of the service account used by the Web UI.
Exploitation
- CISA SSVC: exploitation none, automatable no
- Not listed in CISA KEV; EPSS below 1%
- No public proof of concept or in-the-wild exploitation found at the time of research
Our recommendation
- Upgrade all Web UI instances with authentication to v2-260924 or later
- Identify all instances and their configured credentials
- If an instance was exposed, rotate Basic Auth passwords, Bearer tokens and OAuth2 client secrets, and review logs for requests to unexpected hosts
- Monitor the project repository and advisories for further details or exploit reports
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Pull Request #1557: scope infrastructure requests to trusted origins github.com
- Release v2-260924 github.com
- Eclipse CVE assignment work item 328 gitlab.eclipse.org
- OSV entry CVE-2026-101322 osv.dev
- OpenCVE entry CVE-2026-101322 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:24.
Original description (NVD)
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.