{"id":"CVE-2026-82958","aliases":["GHSA-cgfq-3fv9-5c44"],"url":"https://o3.security/vulnerability/CVE-2026-82958","summary":null,"details":"In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON \"thing\" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.\n\n\n\n\nWhen a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.\n\n\n\n\nExploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.","published":"2026-09-02T10:12:49.085Z","modified":"2026-09-04T03:47:19.726702023Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/764"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82958.json"},{"type":"ADVISORY","url":"https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-cgfq-3fv9-5c44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82958"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-04T03:47:19.726702023Z"}}